Markus Ranum’s popular “6 Dumbest Ideas in Computer Security” is apparently accepted by many. I agree with a couple of his points, but have serious issues on the others.
Here is what Mark had to say in a nutshell:
1) Default Permit –
Allow everything except bad processes and/or users.
I Agree.
There is a lot of this going around and it is dumb. And I say its dumb in total humility, we all do dumb things from time to time. With Windows XP service pack 2, which is basically a firewall implemented on top of the OS and though it is not perfect, I believe that more people are beginning to see the importance of DENY ALL.
2) Enumerating Badness
Listing a concentrating on the thousands of malware as opposed to concentrating on accounting for the legitimate software and getting rid of the rest. It’s a ploy by the man to keep security corporations afloat.
I Agree and Disagree with this.
I agree that it is important to have accountability for what is going great on your system and running as it should. You should know and maintain your “known good” baseline configuration. But it is like protecting your home. Shouldn’t you know what recent rash of crimes are going on in your neighborhood?
Shouldn’t you keep note of those crimes and have a method or practice of protecting yourself. Although it is impractical to seek out every possible type of attack a criminal will use against your home, you should at least have protection against the MOST LIKELY methods that might be used against your home. I believe that being aware of some of the most possible known threats to your system and taking action is like personal insurance.
3) Penetrate and Patch –
Systems should be designed better so they don’t have to be patched.
WTF (What the f*#@!!)
Of course systems should be designed better… and humans should be designed so that we don’t go to war! And there shouldn’t be hunger anywhere on planet earth. Could have, Should have, would have. In a perfect world, I.E. WOULD HAVE been ABORTED. But Internet Explorer was released to all and controlled 95% of the browser for years. Mark, there are systems that need patches. Security isn’t just proactive its reactive. I understand and agree with what you are saying but in the real world millions of people by millions of badly designed and even hazardous products.
4) Hacking is Cool
Mark insists that saying “hacking is cool” or having popular series of “hack” books (i.e. Google Hacks, Mind Hacks) is glorifying criminals.
I Strongly Disagree.
This is yet another example of someone ignorant of what hacking actually is.
I’ve had numerous arguments about this. I don’t care what you say Mark (or anyone else) hacking is and always will be cool. NO!… I don’t believe CRIME is not cool. Hackers are not always criminals. You would have to go to the Defcon to realize this. But Mark seems like the type that would look down his nose at Defcon and everyone there. Many of the vulnerabilities that are discovered before criminals exploit them are discovered by gray hats, hackers who actively or accidentally discover security holes. Many times these gray hats actually warn the companies and are told to sit down and shut.
Even if you did believe that every hacker is a criminal and ALL hacking is a crime, would it not make sense to know your enemy and what he/she does? Criminal Profilers must not only know the tactics of criminals they have to UNDERSTAND them. I was a cop for five years. In my experience, the best cops & investigators understood not only how and why people commit crimes but also how they try and get out of it.
Mark calls hacking “social problem.”
Even TLC (the learning channels) does not take this stance on hacking. Check out their list of the famous & Infamous hackers.
Hackers included on the TLC page:
Steve Wozniak (co-founder of Apple)
Richard Stallman (creator of GNU)
Dennis Ritchie/Ken Thompson (created UNIX)
TSutomu Shimomura (caught Kevin Mitnick)
Linus Torvalds (creator of Linux)
This is a good definition of what a hacker is:
http://en.wikipedia.org/wiki/Hacker#History
Most Information Security professionals (or those claiming to be) either completely understand what “hacking” is or do not understand it at all.
5) Educating Users
Users should be kept dumb.
I disagree.
Social Engineering is the best example of what happens when your users are blind. The biggest threat to any system is the people using them. Kevin Mitnick said, “There is no patch for stupidity.” Really funny, but I disagree the patch is Security Awareness. Check out what the folks at Security Awareness for MA PA and the Corporate clueless blog had to say.
6) Action is Better Than Inaction
It really is easier to not do something dumb than it is to do something smart.
I agree. Very well put.
I would also add a seventh, brought up by Par Kris Buytaert at x-tend.be:
7) Security Can be sold in a Box
Everyone wants a push button solution to all their security issues. The truth is that it does not exist. The only way to beat the game is stay ahead of it. That is not to say everyone should be security geeks, but they should have some understanding of spyware, malware and other filth (that is if they value there accounts, privacy and data).
Over all, I feel that article has a lot to give to computer security community. Its great that there are professionals that put that much thought on what they feel is right.