Thread by @chrissanders88

Like lots of folks, I'm pretty miffed by the lack of robust virtualization support on Apple M1 hardware. I hope that gets fixed soon. But, it also got me to thinking about decision making at big vendors like Apple and others.
1/

For example, the security community (myself included) is often critical of Microsoft for some of their decision-making when it comes to usability/flexibility vs. security. Two things immediately come to mind...
2/

1. Macros. The idea that they exist, are default usable, and the UI pushes users more toward enabling them than disabling them.

2. Default logging configs. Fairly minimal with lots of sec relevant stuff left out (integrate sysmon already!).
3/

In both of those cases and others, at some point, MS is making a decision that leans toward usability/flexibility and away from security. From what I understand, there are small (but not that small) groups these things REALLY matter for.
4/

But, let's compare that to the Apple M1/VM issue. That really matters for a small (but not that small) group too. What is similar about those decisions?
5/

I think most folks probably recognize financial impact first. How much money does the company actually lose if they lose the affected group? I don't really know. But I'm sure it comes into play.
6/

However, let's change a couple of words. How much money does the company PERCEIVE they lose if they lose the affected group?
7/

What I'm getting at here is that some groups are better organized to make their dissatisfaction heard and affect change. Regardless of actual losses (not seen until later), organized groups make expected losses (seen now) more obvious and tangible.
8/

In general, I think information security would be considered a group that is not well organized. We are individually loud, but not so much collectively. At least right now.
9/

Constituents of the groups that push against infosec-related interests are often better organized and make their collective voices heard more easily. Big companies, entire industries, and so on.
10/

I think many in infosec would see Apple or MS as a company that should be "one of us" and default to the best interest of security more often than not on these sort of tradeoffs. Of course, that is not the case.
11/

This gets to something that is certainly not a new question... "How does infosec unify their collective voices to be heard *and prioritized* more?"

I just thought this was an interesting case study that relates to it.
12/

The same question is had at the individual organization and even team levels. But here, I'm talking specifically as it relates to interactions with the few big vendors on whom we all rely. The folks in the best position of anyone to fundamentally improve global security.
13/

Answering the question is a big one. We tend to reject a lot of the traditional mechanisms other groups use to do those sorts of things -- standards bodies, licensing orgs, and so on. Some good reasons for that, but we miss some benefits too.
14/

I do think that organization is a key element of the answer. I also believe that organization in this sense is, in significant part, an education problem. But, I admit that I believe most things break down to education problems. 😂
15/

Anyways, that's how I get from yesterday's Apple event to decision theory to fundamental infosec identity crisis problems. I hope y'all are having a great Tuesday so far 🤣
16/16