Fixing Security Through Obscurity? 66
LineNoiz asks: "I work as a junior developer at a small company that sells check printing software. One of my company's favorite things to tell customers is how secure our product is and how it will reduce check fraud (we even sell check fraud insurance). I cringe everytime I hear them say it, because I know that it is 'secure' only because of it's relative obscurity. I personally know very little about security, and really have no idea what it would take to make our product secure. All I really know is that this is a problem waiting to happen. How can I convince my managers that our security is nothing to brag about? How can I convince them to spend the time and money to make it secure? Where can I myself go to learn more about security and what it would take to make/keep it secure?"
Good troll! (Score:3, Informative)
You even admit to not knowing where it is insecure, or what needs to be addressed in order to secure it. This is a beautiful troll.
Re:convincing the managers (Score:5, Informative)
"Security" features on checks usually are only to prevent someone from photocopying the check, and do nothing to stop someone with a box of checks and a laser printer. No matter what you do while printing the check, Checks are not secure. Most businesses print their checks, and print them in the same manner as I just described, and there is nothing that can be done about it, because banks will cash any valid check, which means only that the account number and signature must match their records (you could write the information on a napkin and the bank would take it, it is a valid check), and banks will rarely flag a check for a bad signature.
If someone gets one of your "secure" checks from a client of this guy's company, orders a box of checks from them, and prints checks, then even the client may not realize that they didn't write the check. That's how checks are, deal with it. If you don't trust the person you're writing a check to, don't use a check, it's just that simple. By the way, it is amazing to me how the banks always say "don't give out your account information to anyone" (and no, I'm not talking about PINs) when it's printed on every check. The only thing worth making "secure" (as in unable to be scanned/photocopied) about a check is the signature line, and very few companies do this, since the only effective means I know of to do this requires a color laser printer and an electronic signature image. (red/black printing scheme, etc).
Re:Just forget it (Score:5, Informative)
One thing to remember, you are a junior developer and you will rock the boat if you are not walking-on-eggshells-careful. This is true even in a good economy.
Trust me, I used to rant about things broken in IT. I was respected for having a lot of knowledge and insight in IT. However much I still believe I was right, I learned, years later that attitude and patience will pay off more than brilliant ideas.
An old saying has to do with attracting flies with honey. Learn that and learn all you can about security on your spare time, to buttress your claims. Show them how good and knowledgable a worker you are, to convince them your opinion is valid.
Don't tell them they are wrong. Just factually show them how they could improve.
(I wrote this in about 3 minutes, so if it doesn't appear coherent, read it again, without mentally spell checking and grammar checking. Sorry about the clutter.)
Do your homework (Score:5, Informative)
Developers, especially young ones, often see things that they think need to be changed, and get frustrated when management seems to ignore their concerns. In many cases, the techies are actually right, but they don't understand that (a) there are many, many issues to be considered that they don't know about and (b) simply claiming that a problem exists isn't enough. You also have to communicate the problem and its solution clearly and effectively, without rocking the boat.
The solution in all cases, not just in issues of security, is to do your homework. When presented with a thoughtful, detailed, documented analysis of a problem, its potential *business* impacts, and a recommended solution, managers generally do take note.
In this case, if you really care about the issue, there are some things you can do that will almost guarantee that you'll be listened to:
First, you need to both educate yourself and construct and analyze a threat model. The "education" in question is more about business and risk analysis than, say buffer overflows and leaky protocols, and the process of building and analyzing the threat model will give you a lot of it.
A threat model generally consists of the following major areas:
After you've created the threat model, you need to analyze it. To do that, you need to try to quantify all of the elements of the model. In the business world that ultimately comes down to assigning dollar values to everything. For each attacker, try to figure out how much they could steal by attacking the system. Even harder, try to quantify the value of attacks for ideological reasons (if any). For each risk, quanitfy how much the company stands to lose if the risky situation happens. For each avenue of attack, try to quantify the cost of performing the attack.
Once you have dollar values for everything (many will have to be expressed as ranges, and all will be built on guesswork), look to see if there is any combination of motivated attacker, risk and avenue that looks like a "good attack". That's an attack in which it's in the attacker's best interest to perform the attack, taking into consideration the possible negative effects as well as the benefits, the attacker's motivates, access, resources, etc.
Think long and hard about all of the good attacks, try to assign probabilities to them based on everything you've learned (plus another crapload of guesses, of course) and you should able to come up with an expected cost for each of them.
The last stage of the analysis is to try to guess at the cost of fixing them. Don't even bother trying to think about financial "benefits" of fixing them... "You can tell all the customers that its *really* secure!" doesn't mean much because they can *already* tell the customers that. It may not be true, but you're wandering into marketing, where truth is... flexible.
You're not
Re:Art of the Steal (Score:0, Informative)