All about the Benjamins.
While Hutton and Bejtlich go point-counterpoint ("Alex, you ignorant slut ..."), I’ll just riff off of Hoff, not just because it tickles my alliteration funnybone ...
Chris points out the growing horror of endpoint security software sprawl, to which I just want to ask one question:
How much of this proliferation is a desperate attempt to protect against your own users?
Chris writes: “After all, the endpoint is the closest thing to the data, so the more endpoint control the better, right?”
Not quite. The endpoint is the closest thing to the USER. Who is opening attachments, downloading software, browsing questionable sites, mailing himself confidential data, and generally ignoring both policy and good technical sense. Let’s take a look into the future, where we’re all on blades. Where are you going to see the most security at that point?
I submit that there is only so much you can do to protect your enterprise data against the people you’re allowing to access it. The overarching priority should be to simplify user interfaces and educate the users (yes, with a cluebat if necessary). You’ll still have self-propelling worms and hostile scans to deal with, but you’ll be so much better off if your users simply don’t open strange attachments or go to AdultFriendFinder.com.
We tend to rely more heavily on technology, because let’s face it: most of us in this field are introverts and we don’t like talking to real live people if we can possibly help it. But as security people, we can’t be everywhere. We can’t be clicking the mice for all the users, and we certainly can’t watch every move. We should be simplifying what users can do as far as possible so that there are fewer ways that they can shoot themselves in the foot, and then we should be teaching them gun safety.
Hoff is right: we are getting to the point where we are deploying too much complexity, which in itself creates security problems. We’re slapping one Band-aid after another on top of an already complicated mess. Let’s get back to the root cause and address that instead.
on 09/02 at 11:16 AM:
on 09/02 at 05:18 PM:
The pendulum has already started swinging back to terminal devices instead of fat clients...for better or worse.
That certainly simplifies what users do!