keeping the lights on - of theory and...

Keeping the lights onOf theory and practice

Presented byRalph HolzSchool of Information Technologies

About the speaker

– Lecturer in Networks and Security, USYD

– Leading Node for Cybersecurity in Human-Centred TechnologiesCluster

– Research streams:– Empirical Security Analysis and Engineering– Blockchain Security

– Teaching:– Security Engineering

Keeping the lights on | Ralph Holz 1

Theory and practice

Figure: xkcd.com

Keeping the lights on | Ralph Holz 2

Hard to get numbers

Figure: dilbert.com

Keeping the lights on | Ralph Holz 3

What are our problems, really?

– Critical infrastructure is vulnerable?

– Internet of Broken Things?

– Advanced Persistent Threat?

– Are we doomed?

– Is any of this new?

Keeping the lights on | Ralph Holz 4

What are our problems, really?

– Critical infrastructure is vulnerable?

– Internet of Broken Things?

– Advanced Persistent Threat?

– Are we doomed?

– Is any of this new?

Keeping the lights on | Ralph Holz 4

What are our problems, really?

– Critical infrastructure is vulnerable?

– Internet of Broken Things?

– Advanced Persistent Threat?

– Are we doomed?

– Is any of this new?

Keeping the lights on | Ralph Holz 4

What are our problems, really?

– Critical infrastructure is vulnerable?

– Internet of Broken Things?

– Advanced Persistent Threat?

– Are we doomed?

– Is any of this new?

Keeping the lights on | Ralph Holz 4

What are our problems, really?

– Critical infrastructure is vulnerable?

– Internet of Broken Things?

– Advanced Persistent Threat?

– Are we doomed?

– Is any of this new?

Keeping the lights on | Ralph Holz 4

The new threats?

– None of the security vulnerabilities are new in nature.

– The scale is new, but:

– It really is a case of a changed threat model.– The attackers are organised and better funded.– They have a very different motivation.

– But does this mean we need the latest and greatest?– Not wrong to invest, but make it defence-in-depth

Keeping the lights on | Ralph Holz 5

The new threats?

– None of the security vulnerabilities are new in nature.

– The scale is new, but:

– It really is a case of a changed threat model.– The attackers are organised and better funded.– They have a very different motivation.

– But does this mean we need the latest and greatest?– Not wrong to invest, but make it defence-in-depth

Keeping the lights on | Ralph Holz 5

What we really see

Figure: Covering the wrong bases (P. Gutmann, 2014)

Keeping the lights on | Ralph Holz 6

Where are the vulnerabilities?I would argue that we are getting most of the basics wrong.

– Server-land (from our own studies):– Even if good technology exists, it is not deployed

(complexity)– Complexity is the enemy of security– Delicate trade-offs between availability and security

(revenue!)

– Office-land:– Users are blamed (instead of usability)– Phishing and social engineering penetrate even the fanciest

defences

– Wrong advice is perpetuated in compliance-driven security

– Reaction to successful attack is neglected

Keeping the lights on | Ralph Holz 7

Measuring security

Any security technology whose effectiveness can’tbe empirically determined is indistinguishable fromblind luck. - Dan Geer

Keeping the lights on | Ralph Holz 8

Policy

– Vendors should not be allowed to sell Internet-facing productswithout a certification

– What we really need to think about is how to design security testsfor products

– This is the opposite of compliance-based security

– This is a job for policy-makers, not technologists

– Would love to see more evidence-based policy-making– Yes, that is a call for more security measurements

Keeping the lights on | Ralph Holz 9

Remedies: education in security

– Security needs to be an obligatory part of very curriculum– USYD: part of ‘Integrated IT’ core units

– Some engineering topics:– Assessing security in design and practice– Threat modelling– Privacy– Usability

Keeping the lights on | Ralph Holz 10