"Security is our top priority" is meaningless

> Most computer security work doesn't think this way.

The computer industry is determined to relearn the well-known lessons the hard way.

For example, we still have a single password breach brings down the entire system. It's like building a battleship that would sink if a 2 inch hole in the hull happened.

The way to make systems secure is not to devise a perfect password system. The way is to make the system secure in spite of password breaches. It's a completely different mindset.

To return to the battleship analogy, it isn't about preventing holes in the hull. It's about surviving holes in the hull.

> The military views security as time-limited.

In my time as a computer security specialist, this has been the most difficult thing to get other computer people to understand.

Especially when it comes to cryptography. No cryptographic system can, or is intended to, keep something secret indefinitely. The whole point is to keep the secret for long enough that by the time it's cracked, the information itself is out of date and therefore disclosure is no longer harmful (or, at least, is much less harmful).

All security, computer or otherwise, is like a fire door. No fire door will hold back a fire forever. They are all rated in terms of the number of hours they'll be effective in a fire. Security must be thought of in similar terms.

But I understand. People want perfect security and wishful thinking is seductive. People also want security "for free" -- meaning something they can install or configure and then not have to worry about it anymore. But that's impossible, in large part because actual security doesn't have a technological solution. Security is a process that depends on proper human behavior. Technology can and does act as a "force multiplier" here, but a security approach that is 100% technological is a security approach that will be subverted sooner or later.

Interesting that your experience was a double increase in costs from going up in security level. My experience was it was an order of magnitude (10x) at each level .

E.g., OFFICIAL let's say is $1,000,000 PRIVATE becomes $10,000,000 SECRET becomes $100,000,000

What we did experience was the cost in time to deliver a service doubled however. E.g., OFFICIAL was 3 years, PRIVATE was 6 years and so on. I expect it varies significantly between types of system, ours was a SaaS platform that read telemetry from embedded systems on assets in the field, so I'd assume that would be one of the drivers for my differing experience than yours.

I agree with the solution, but what do you mean with "better" in the first sentence? Spelling out the complete approach wasn't suitable for the article, but the ISO 27001 framework spells out roughly what you describe. At each "security classification level" you have a different risk appetite, and will apply different controls.

On a somewhat related note, I once worked on a vessel which had 'SAFETY FIRST' stencilled onto the superstructure (quite common).

Underneath, someone had stencilled in slightly smaller script 'second only to profit'

(Somewhat less common, but refreshingly honest. Or cynical. Or both)

Frustrating but recognizable. Having a framework in place allows you to quantify the risk and effort, and makes it less of an opinionated shouting match and more of an analysis. The challenge will then be to get everyone to take the time to understand the framework.

Looking at it another way, he put an end to further spending on "security talk" by putting up the security talk of security talks.

Art of the Deal indeed.

> but let pen tests, post-mortem analyses and such speak to their robustness/lessons they've learned.

It depends on which audience you want to reach when you want to advertise how secure your product/service is. Most people outside IT security have no idea what a penetration test is nor can they make sense of jargon-heavy post-mortems.

I agree entirely.

> I'd rather a company not just give self-appraisals of security

Companies routinely lie right to your face. No company's self-appraisal about anything is worth paying any attention to.

> A ship in port is safe. But that’s not what ships were built for.

arsa Grace Hopper, who was quoting John Shedd.

When I started to work at a big company on car safety, my manager told me as a joke: "the safest car is the car that doesn't move".

That’s beautiful and succinct. I wasn’t aware of it, thanks for sharing!

What if two other aims, combined, outweighed the desire for safety?

I think github is an example of those. 9 of 10 integrations just ask for blanket permissions. Effectively, "give us permissions to edit and make commits to all of your repos, and every other possible thing that's possible to do on github and in return we'll setup everything so our service works for you immediately"

Vs, here's 10 to 20 steps you can follow to give us the minimum permissions to use our service with a single repo. Go manually make repo specific tokens with specific permissions (10 steps) then go paste those tokens into our service (4-5 steps), now go add these actions to your repo (4-5 steps) and set these settings in that repo (5-15 steps)

So in this case, security is at odds with UX.

IMO, this is github's fault. Instead of providing an API and UX that would let users specify specific repos and choose specific permissions per repo, they did the more obvious and technically simpler thing. But, unfortunately, the more obvious easier thing, means the path of least resistance for integrations to do is ask for all permissions.

I would argue you could paint that as github has not made security their top priority. If they cared about security then the path of least resistance would lead to the most secure integrations instead of what they have now which leads to the least secure integrations.

My employer uses Microsoft as a single sign-on and the poor UX is a huge risk. People just get sick of endless shoddy login prompts and authenticator app warnings. It trains users to enter credentials without enough thought. Something like passkeys could be so much better. Security needs to consider unintended consequences of user behaviour much more thoroughly.

I don't know about impact on UX, but I do think it's true that security and convenience are opposed to each other. Increased security comes at a cost of decreased convenience.

I can't prove this is a fact, but I do know that I have yet to see an exception to it.

While this is correct, it's also not a particularly useful point.

A company can't just do profit. Profits aren't a thing that a company can choose (typically), they aren't an input, they're an output. You can't choose your outputs, you can only choose your inputs and aim them towards specific outputs.

How do you achieve profits? Well you do things that your customers want, and one of those things might be security. For some companies, the input of investment in security will result in the output of profits. For others it won't, or the two will be less correlated. If security does convert well into profits then it follows that it should be a priority input for the company, because that's how they will achieve profits.

This is still a huge generalisation, but perhaps less of one than "profit is the top priority".

Author here. I agree with what I think you mean, but stating it like that is too simplistic in my view. Money is a great way to measure effort and results, and it's top priority in that at the end of the line, without profit there is no company. But without people, products, a mission, and not being hacked too many times, there is also no company.

The owners getting rich is the top priority

It’s a pretty powerful one-liner right? ;)

I always finish that sentence in my head with something like "we care about your privacy so much that we want to collect all your personally identifiable data and sell it".

I actually think these are very different.

Big tech companies generally care about security because most of the time, it aligns with their self-preservation. They don't want their secret sauce leaked, they don't want internal mails and payroll posted on the internet, they don't want their users hurt. It's not "top priority", but security probably shouldn't be your top priority; if it is, there is only one winning move: don't build anything. That said, security often ranks high, especially if the company had a couple of close calls before.

In contrast, preserving privacy is often in direct contrast to business goals. You want to preserve it to some limited extent to maintain user trust and avoid offending the regulators, but there is a constant business pressure to get real close to that line.

These companies do not sell security, they sell products that need to be secure. The restaurant sells food which needs to be safe.

A more apt analogy would be a restaurant saying "food safety is our top priority". To me that sounds like a restaurant that wastes a lot of plastic and produces a lot of food waste that might spoil soon.

Better link: <https://dilbert-viewer.herokuapp.com/2004-03-28>

When Microsoft pivoted to security, they seemed to really mean it. They stopped shipping new features for something like 6 months, and spent the time hardening the OS. The results weren't perfect, but they made Windows not the total joke it had been.