Robert Graham 𝕏 Profile picture
Aug 28, 2020 30 tweets 5 min read Read on X
Okay, I'll bite.

1/ The Internet is secure enough. Sure, in some cases we can improve networks with more security, but in many cases, more security makes things worse, not better.
2/ Infosec professionals arguing for more security are a lot like those who argue for police states or military industrial complex. We try to argue from a position of moral authority, that security is a moral imperative rather than a marginal benefit that exceeds marginal costs.
3/ Burnout comes from failure at internal corporate politics -- such as failure to convince people that more security is necessary. It's not seen this way. Nobody describes "my corporate political battle" but "I'm right -- which they'd see if not for their corporate politics".
4/ Your management claims "security is our #1 priority" but they lie. Management wants NOT to excel at security, but be at most slightly above average among their peers. Your fight to excel at cybersecurity within your organization therefore can't win:
blog.erratasec.com/2020/07/how-ce…
5/ You can win at corporate politics if you stop thinking of your co-workers/management as people who can be reasoned with, and start thinking of them as targets of social engineering. The best social engineering trick is sincerely listening to what they have to say.
6/ "Technical debt" would be a useful metaphor -- except that people don't understand finance or debt, but instead share common misconceptions and prejudices against debt. It's thus a political term for internal corporate politics rather than a useful metaphor.
7/ Whether "victim blaming" is good/bad depends upon your political affiliation with the victim. Richard Clarke's "corporations deserve to be hacked if they spend less on security than coffee" is a clear example of victim blaming that our community doesn't condemn.
8/ If "defense in depth" always requires more spending, then simply say that the principle is "more spending means more security". The term is really trying to hide that people's actual agenda is to increase budgets, increase spending, and build empires.
9/ Technical certifications like the CISSP are created by people who themselves aren't terribly qualified, who themselves do not understand the technology. It's like tests for doctors created by somebody with an associates degree in hospital management rather than medical degree.
9a/ There is much discussion about a "skills shortage" in infosec. Well, yes, when those without skill are in charge of certifying skills, what do you expect would happen?
10/ A CISSP is useful for getting a job that requires a CISSP -- which is to say, getting hired by management who themselves have little clue, and who will not be able to provide much personal growth or mentoring.
11/ Security is a product, not a process. Know your limitations. If your org has non-technical management, requires CISSPs, and is riven by out-of-control political fights, then it's not going to be able to manage people to create robust processes. It must rely upon products.
11b/ Saying "security is a process, not a product" is like saying that everybody should be above the median (or above average). It's saying that to excel at security that you need the sort of organization that already excels.
12/ There are only a few areas where I'd advise management to do better than their peers. The most important is dealing with lateral movement of ransomware using Windows networking.
12b/ You think you've got ransomware under control because it keeps hitting desktops and you keep cleaning it. You don't realize you are dodging bullets, that if it hits a DOMAIN ADMIN desktop, then every desktop/server in the org gets hit and everything goes down.
12c/ In The Matrix, even Neo eventually couldn't dodge them all and got hit by a bullet. The trick is to reach the point where you don't have to. Solve lateral movement. Image
13/ The infosec industry plays politics but doesn't pay attention. NSA 0days like ETERNALBLUE wasn't responsible for notPetya's devastation, as the politics argue. The devastation was caused by lateral movement via Windows networking.
14/ In the four years since the Mirai worm/botnet/ddos, over 10 billion IoT devices have been attached to the Internet, yet the potential exposure of Mirai-style vulnerabilities has actually gone down (according to my scans of the Internet).
15/ After Mirai, in government circles, saying "worm" meant "IoT worm", saying "botnet" meant "IoT botnet", saying "DDoS" meant "DDoS from IoT devices".

But since Mirai, worms, botnets, and DDoS have been almost solely a Windows problem.
15b/ It's hard reasoning with people when you think you are talking about the same thing, such as "botnets", until you come to the realization you are talking about removing admin privileges from Windows and they are talking about IoT regulation.
16/ Be wary of cybersecurity "experts" who stress:
* choose strong passwords
* keep up to date on patches
* don't use public wifi
* don't click on suspicious links/attachments
16b/ These statements are subtly deficient. I think it's an IQ test where people can't see what's wrong with statements like "be suspicious of suspicious looking emails" and "don't trust untrustworthy links".
16c/ By far the most important general consumer advice is "don't reuse passwords on important sites". Your email password should only be used for email. Some additional advice:
blog.erratasec.com/2017/11/your-h…
17/ "Cybersecurity" is a fine word.
18/ Learn more programming, SQL databasing, syadmining, netadmining, Chrome devtooling, command-lining, and the crypto. People impress me with other job skills that I could never have, but at the same time, our industry as a whole lacks necessary technical skills.
18b/ The Snort IDS has always been deficient in TCP reassembly. Yet, it's impossible to discuss this problem because people don't really grok TCP reassembly.
18c/ To repeat, I'm not saying TCP reassembly ignorances make you bad at your job. People who are phenomenal at their job and who contribute loads to the community don't understand it. It's just that as a community, we should value more understanding such things.
19/ So IPv6.

Me: "I don't understand. Why do we need IPv6?"
Them: "Because IPv4 has 32-bit addresses, limiting it to only 4-billion devices on the Internet".
Me: "I don't understand. There are 20 billion devices on the IPv4 Internet already".
19b/ To be clear, I've failed to understand the 4-billion device limitation of IPv4 since 1992. It's fun watching people trying to explain, using ever simpler terms so that even a child can understand that 32-bits means a maximum of 4-billion.
19c/

Question: "Why IPv6?"
CISSP test answer: "Bigger addresses"
Correct answer: "Preserve end-to-end principle and reduce routing table size"

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Robert Graham 𝕏

Robert Graham 𝕏 Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @ErrataRob

Sep 17
By the way, the energy density of C4 is 6.7 megajoules/kilogram.
The energy density of lithium-ion batteries is about 0.5 megajoules/kilogram.
C4 will "detonate" with a bang.
Lithium-ion batteries will go "woosh" with a fireball, if you can get them to explode. They conflagrate rather than detonate. They don't even deflagrate like gun powder.
To get a lithium-ion battery to explode (in a fireball) at all, you have to cause physical damage, overcharge it, or heat it up.
Causing heat is the only way a hacker could remotely cause such an event.
Read 8 tweets
Jul 21
I don't want to get into it, but I don't think Travis is quite right. I mean, the original 25million view tweet is full of fail and you should always assume Tavis is right ....

...but I'm seeing things a little differently.
🧵1/n
2/n
DON'T TRY THIS AT HOME

I'm a professional, so I can take the risk of disagreeing with Tavis. But this is just too dangerous for non-professionals, you'll crash and burn. Even I am not likely to get out of this without some scrapes.
3/n
To be fair, we are all being lazy here. We haven't put the work in to fully reverse engineer this thing. We are just sifting the tea leaves. We aren't looking further than just these few lines of code. Image
Read 14 tweets
Jun 18
The reason IT support people are so bitter is that YOU (I mean YOU) cannot rationally describe the problem:

You: The Internet is down
IT: How do you know the Internet is down?
You: I can't get email.
IT: Is it possible that the email servers are down and the Internet is working just fine? Can you visit Twitter on your browser?
You: Yes, I can visit the twitter website.
IT: Is there any reason other than email to believe the Internet is down?
You: The last time I couldn't get email it was because the Internet was down.

The fact that IT doesn't call you a blithering idiot on every support call demonstrates saintly restraint, even if a little bit of their frustration leaks through.
A lot of good replies to my tweet, but so far this is the best:
I very much like this rebuttal. I was think of "driving a car" analogy, but this tweet says it much better.
Read 5 tweets
Apr 12
Uh, no, by any rational measure, only Trump has had respect for the forum.

Televised debates aren't about "debate" but charisma and media training, where they craft an answer regardless of whether they believe it.

Trump is the only candidate who gives sincere answers.
Trump is pure evil, the brutality of his answers appeals to ignorant brutes who reject all civilized norms.

But the yang to Trump's yin is a liberal elite like Rosen whose comfortable with the civilized norm of lying politicians who play this game of deceitful debates.
To be fair, Biden (and Obama and Bush before him) have stood up for important democratic principles, the ones that Trump flatly reject. But still, the system has gotten crusty. There's no reason to take presidential debates seriously as Rosen does.
Read 4 tweets
Mar 21
I've read through it.

It's the same as all Ben Cotton's analysis's, looking for things he doesn't understand and insisting these are evidence of something bad, that the only explanation is his conspiracy-theory.

I can't explain the anomalies he finds, either, but in my experience as a forensics expert, I know that just because I can't explain it doesn't mean there isn't a simple explanation.

For example, he points to log messages about mismatched versions. I know from experience that such messages are very common, I even see them in software that I write. It's the norm that when you build something from a lot of different software components, that they will not be perfectly synchronized.

That he would make such claims based solely on log messages of mismatched versions proves that he's really not competent -- or at least, very partisan willing to be misrepresent things.
In particular, I disagree with his description of these files. In the C#/.NET environments, creationg of new executables is common. In particular, these are represent web server files. It's quite plausible that as the user reconfigures the website, that these executables will be recreated.

I don't know for certain. I'd have to look at Dominion in more detail. I just know that if any new C#/.NET executables appear in the system that they are not automatically new software.Image
The certification process looks haphazard and sloppy to me, so it's easy for me to believe that uncertified machines were used in elections.

But nothing in Ben Cotton's report suggests to me that this happened. He's not looking for an explanation for the anomalies he finds, he already has an explanation, and is looking for things that the ignorant will believe is proof of that explanation.
Read 4 tweets
Feb 16
This is an incredibly important article and Charlotte Cowles (@charlottecowles) should be praised for writing it. Everybody should read it.


People laughing at her for getting scammed are missing the point, such as what the following picture does. thecut.com/author/charlot…
Image
No, I wouldn't have gotten scammed like her. For one thing, I believe every phone call is a scam, either a criminal one, or some vendor trying to waste my time getting me to pay for things.

But I hate to think what I might fall victim to.
The only real defense is reading articles like the one above. Forget advice about what you should/shouldn't do told to you in a vacuum, instead, read about such stories about what sorts of scams actually happen in the real world.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(