Security Saturday!

Personally I hate it when people get all muddle-minded and think that their political opinion matters just because they have a platform in some other branch. I have the wonderful privilege of your audience and I thank you for it. What I will talk about today applies to both security and politics but will not touch any sane political framework. Your beliefs are safe, this will not be politically charged, it will just hint at a mental tool also usable for politics.

If what I write here today seems at odds with your politics or beliefs, you are welcome to comment. It does not mean that your politics or beliefs are wrong, it probably means they are not articulated well. Because what we talk about today is: Darkness versus Light.

Classic, I know.

In software development there are terms like white-box, grey-box and black-box testing (which I touched upon in earlier posts). White-box means you have access to the code and the program in action. Grey box means you have a blueprint or general description of the program, and access to the program in action. Black box means you have no real idea about what should be going on, you only have the program in action itself.

In security we can do several similar things when securing applications. We can have a veil of darkness (call it encryption of some form), a glorious daylight (no encryption whatsoever) or a dull grey (encryption where it matters). Similarly with our politics and beliefs we can have a veil of darkness (we don't know what we believe other than intuitively), a glorious daylight (we know exactly how things are, and no-one can say otherwise) or a dull grey (we know what we believe, but some things are clear and others are not).

In all of these situations I am going to argue that the grey is the best place to be. The best security comes from knowing what you know, and being aware of what you do not know. Knowing everything is often a maze of rules and white rabbits, while knowing nothing leaves you without direction.

A practical example is when perusing logs for something that you know happened, but you are trying to estimate the impact of. At work we had this when we discovered a bug that happened when someone would press "agree" on a warning message, and that would trigger the exact opposite behaviour of what the warning message said it would. Since this was in our access control subsystem it meant that information was disclosed to people that should not see that information, and as such we needed to know who fell victim and needed to be informed and remedied. That was when we discovered that we did not know what we did not know, it was a black box. We had logs, but they were extensive. The exact confirmation action itself was not logged properly because of the rewriting of some legacy code (which is an issue onto itself). In the end we derived the information we needed from some other logs, but it took a while and was far from painless. Needless to say we staged a fix that would give us more log precision in the next version of our application.

A practical example in the other direction comes from my personal experience at work (with this one I was directly involved). I am not a developer at my current Job, but an analyst. This means that I am responsible for keeping an eye on logs and other data sources to make sure that things are not derailing. I am also responsible for following up on antivirus hits, phishing mails and documenting of past incidents. In this line I was asked to find out why a specific email was not being delivered to customer.

After looking for a while I found an answer, and it was the wrong customer who also did not get their emails. In this case we were too white-boxed. I had access to too much information and was blindsided. Since I did not know what exact type of failure i was looking for, I did not filter well enough and ended up giving my boss's boss some very weird advice (my direct boss was out, I was basically the only security guy at the office...). After figuring out what I did wrong I worked together with the support desk employee to find the correct email.

These examples give us an idea about sanity and light and darkness in thoughts, beliefs and politics as well. if everything is clearly defined, you are likely to get an information overload and miss the important information that you actually need. On the other hand, if your beliefs, thoughts and politics are like a black box only running on intuition you are likely to completely miss the information you need to actually make an informed decision.

Therefor in all these situations my view is that you need to be informed about the right things. Know a little bit about agriculture before you legislate on it. Know a little bit about how science works before you put your politics on top of it. No need to get into the details and get yourself a whiteout, but do add some light to your darkness so that you can see under the pleasant light of an overcast day.

I am sure this works on even more areas of life, stay safe out there!