Six reasons there are still so many security breaches.
Hi everyone. Leo.\ Notenboom
here for askleo.com.
Here's a question.
I can see how an individual might let their guard down and get hacked,
but how in the world can a huge company like AOL let this happen?
Honestly, the very short answer is because security is really, really hard.
Now, there are a number of different reasons, and I'm going to explore six
of the different reasons that factor into why I say that.
Number one, all software has bugs.
No exceptions.
If somebody tells you that a piece
of software has no bugs, they're either misguided or they're lying to you.
This is not uncommon when people are
trying to sell you on the benefits of this software over that software.
All software has bugs.
Now the ideal is of course, that all the high priority,
really severe bugs, they've been found and they've been dealt with.
But that doesn't necessarily mean that everything has been it can't be.
So what that means is that hackers and others are basically constantly poking
at software, trying to find out where it might break and exactly how those breaks
might allow them to then exploit and break into the software.
Not all software bugs are vulnerabilities.
Sometimes they're just things not working the way they should.
But sometimes software bugs can be
leveraged and turned into vulnerabilities by hackers trying to get in.
Number two, today's systems are, I'll just say, unimaginably complicated.
They really are.
When you think about the amount
of software, the millions and millions of lines of instructions that go
into something like Windows, or something like your banking software,
or any of the apps that you might use, it's incredible.
It's incredibly complicated.
What that means, of course, is that there is no single person who can
have a picture of the whole thing in their head.
This is done by people working together. Well.
People don't communicate as well as they should, and as a result,
sometimes there are misunderstandings, things that are easily overlooked,
things that essentially end up resulting in that first item, bugs.
That's usually where bugs come from.
But the bottom line is that things are so incredibly complicated that even if you
had two pieces of bug free software that had to somehow interact with each
other, chances are there'd be bugs in the interaction.
So it is complexity that makes a lot of this so incredibly difficult.
Number three, you can't retrofit security.
By that I mean, if you have a piece of software and you
like it and it's working, and you add a feature to it that now
requires some amount of security, like say you add a payment processor,
you're able to sell things to your website.
Software really hard to retrofit that.
Security is one of those things that needs to be baked in from the beginning.
This is one of the reasons that MSDOS was left behind.
Windows 95 98 se, those kinds of things.
They were all based on MSDOS.
MSDOS did not have security baked in from the beginning.
When we switched to Windows 2000,
Windows XP and so forth, we built on a completely new code base
that had the fundamentals of security architected in from the very beginning.
Unfortunately, not everybody has the luxury of starting
over when they suddenly decide they need to have something that requires security.
As a result, sometimes things get bolted in with less than perfect results.
Number four complexity and evolution are at odds with security.
Windows is ancient by software standards.
It's been around forever.
So is Linux.
So is Mac OS.
They have each evolved over years.
Evolution increases complexity.
These systems do not get simpler over time.
So as complex as they were last year, they're more complex today.
And that means there are more opportunities to get things wrong.
Number five you need security experts to do security right.
Security isn't something you can do as a sideline,
especially for very important things like operating systems and banks and such.
You really need people who understand security deeply to make sure that it's
been implemented right and that all of the cases are being considered.
That's not always the case.
It's not always an option.
If you're a small startup and you're
expecting a lot of people to have a lot of different hats,
to do a lot of different jobs, one of them might be security.
Hopefully you'll hand it to somebody who is the most capable,
but they're still not living, breathing, eating security every day, all day.
They're doing it as a side job and as a result they may not necessarily think
of all the things that should really be thought of when putting together a system.
Number six people.
People are the weakest link.
There's no way of getting around that.
No matter how much security, no matter how bug free you think your code
is, people will get around whatever it is you put in place.
Many, if not most of the breaches you hear
about today are actually the result of phishing attacks.
People who have opened an attachment
that they shouldn't have opened, people who have allowed malicious software
onto their corporate network and then it worms its way into hack the computers,
exfiltrate the data, basically cause the breach.
People are the biggest issue when it comes to security.
We can do a lot.
We can make it harder to open malicious attachments.
We can isolate people from things they shouldn't necessarily have access to.
We shouldn't necessarily be all on the same network that also grants
access to the most secure and most important information.
But these are all things that, to roll it back up,
need to be thought of beforehand, need to be baked in from the beginning
and need to be done in as safe and secure a way as possible.
The best systems cannot assume
that security problems will never happen because security problems will happen.
There will be breaches, there will be mistakes of one form or another.
The best security protocols are about what do you do when they happen?
Do you have a way to figure out what happened?
Do you have a recovery plan in place?
Do you have backups?
Do you have communications for your customers?
Do you have ways to make sure that they
feel secure after something bad has happened?
These are all important things, but they are all more realistic and more
pragmatic than ever, thinking you could prevent breaches completely.
Hope that little bit of reality helps you understand what's going on.
For updates, for comments, for related links and more, visit askleo.com/14424
I'm Leo Notenboom.
This is Askleo.com. Thanks for watching.