We have failed. Decades of ignorance have brought us to this point, right now, where software is universally insecure. It's tempting to hope that someone else will make things better, but letting things slide is exactly what got us here. Pointing to problems is not enough, either. We must pick ourselves up, dust ourselves off, and start fixing things. We must each take a problem -- no matter how small -- and fix, or help fix, the root cause.

1. Stop complaining and solve a security problem instead
Stop complaining and…
Solve a Security
Problem Instead
By Ivan Ristic
1 / 35

2. Stop complaining and solve a security problem instead
I am a compulsive builder ModSecurity 1)
(open source web application rewall), 2) Apache
Security (O’Reilly, 2005), 3) SSL Labs (research
and assessment platform), 4) ModSecurity
Handbook (Feisty Duck, 2010) 2 / 33
2 / 35

3. Stop complaining and solve a security problem instead
Message for today Software is
3 / 33
universally insecure, and we are not
doing enough to make things right.
3 / 35

4. Stop complaining and solve a security problem instead
Morris Worm
In November 1988, the rst
computer worm infected
about 10% of the Internet
4 / 33
(about 6,000 servers). e
worm was written by
Robert T. Morris.
(e worm source code is available from
www.foo.be/docs-free/morris-worm/.)
4 / 35

5. Stop complaining and solve a security problem instead
e Morris Worm spread using
password cracking, server 5 / 33
miscon guration, buffer over ows,
and remote code execution.
5 / 35

6. Stop complaining and solve a security problem instead
Same as today, eh? We haven’t seen
6 / 33
an improvement in computer security
in the 22 years since the rst worm.
6 / 35

7. Stop complaining and solve a security problem instead
In fact, the situation has become much
7 / 33
worse because of the wide adoption of
computers and the Internet.
7 / 35

8. Stop complaining and solve a security problem instead
Why? Four reasons:
1) ignorance, 2) convenience,
8 / 33
3) economics, and 4) no single point of
control, but ultimately because
security is not important to us.
8 / 35

9. Stop complaining and solve a security problem instead
9 / 33
Software is a
market for lemons.
9 / 35

10. Stop complaining and solve a security problem instead
George A. Akerlof
e Market for “Lemons”: 10 / 33
Quality Uncertainty and the
Market Mechanism
10 / 35

11. Stop complaining and solve a security problem instead
“[…] the presence of people who wish
11 / 33
to pawn bad wares as good wares tends to
drive out the legitimate business”.
11 / 35

12. Stop complaining and solve a security problem instead
Security comes from making sensible
decisions, thinking things through, 12 / 33
taking your time… It is boring and it
doesn’t make anyone rich.
12 / 35

13. Stop complaining and solve a security problem instead
Open source projects just want to
succeed, companies want to make
13 / 33
pro t, people want to get things done.
Security is standing in
everyone’s way.
13 / 35

14. Stop complaining and solve a security problem instead
Only one solution long-term: make the
14 / 33
parties involved accountable for the quality.
But we are probably not ready yet.
14 / 35

15. Stop complaining and solve a security problem instead
Self-certi cation
Could help us focus on those
who really should be liable. 15 / 33
(e Software Facts label taken
from Jeff Williams’s talk at
AppSec Europe 2005.)
15 / 35

16. Stop complaining and solve a security problem instead
How to… really x security issues
Design platforms, libraries, and
16 / 33
components in such a way that
vulnerabilities cannot exist.
en use them.
16 / 35

17. Stop complaining and solve a security problem instead
Start small Do one thing, no 17 / 33
matter how small. Repeat.
17 / 35

18. Stop complaining and solve a security problem instead
Kaizen Philosophy of
18 / 33
continuous improvement.
18 / 35

19. Stop complaining and solve a security problem instead
Kaizen Continuous small
19 / 33
improvements will yield large
compound improvement over time.
19 / 35

20. Stop complaining and solve a security problem instead
Start small In your current
20 / 33
project, make all new work secure.
20 / 35

21. Stop complaining and solve a security problem instead
Start small In your next project,
21 / 33
replace as many insecure components
and practices as possible.
21 / 35

22. Stop complaining and solve a security problem instead
Start small ink about how to
22 / 33
solve a known security problem. ink
some more next week. Help solve it.
22 / 35

23. Stop complaining and solve a security problem instead
Start small Reach out and inspire 23 / 33
someone else to do start small.
23 / 35

24. Stop complaining and solve a security problem instead
Start small Find an in uential24 / 33
person. Inspire her.
24 / 35

25. Stop complaining and solve a security problem instead
Start small Become an in uential
person. Join a popular open source 25 / 33
project, or an important company.
Change the world.
25 / 35

26. Stop complaining and solve a security problem instead
Summary What we can do:
1) change ourselves, 2) contribute to
26 / 33
the body of knowledge, 3) inspire
others, and 4) make a difference.
26 / 35

27. Stop complaining and solve a security problem instead
Example We need to transition to
27 / 33
a world without plain-text protocols.
How? Start by xing SSL.
27 / 35

28. Stop complaining and solve a security problem instead
Example: Fixing SSL (1)
Performance Improve protocols to address latency
1)
28 / 33
issues, 2) major sites support improvements, 3) one browser
gets a performance edge, 4) other browsers follow.
Google is already doing this, and we
should help them.
28 / 35

29. Stop complaining and solve a security problem instead
Example: Fixing SSL (2)
No support for modern TLS features 1) Realise that
29 / 33
the underlying libraries are lacking, 2) understand why,
3) fund development, and 4) continue funding development.
29 / 35

30. Stop complaining and solve a security problem instead
Example: Fixing SSL (3)
Bad con guration Raise awareness (but that won’t
30 / 33
1)
work), 2) target library developers to drop obsolete features,
3) target vendors to ship with secure defaults
30 / 35

31. Stop complaining and solve a security problem instead
Example: Fixing SSL (4)
Virtual SSL hosting Realise that we won’t get virtual
1)
SSL hosting until Windows 31 / 33 is retired, 2) put pressure on
XP
Microsoft to change their mind, 3) nd one person at Microsoft
who can change things.
31 / 35

32. Stop complaining and solve a security problem instead
Example: Fixing SSL (5)
Certi cate authority trust issues Wait for a wide
32 / 33
1)
adoption of DNSSEC, 2) put certi cates into DNS,
and 3) improve browser user interfaces.
32 / 35

33. Stop complaining and solve a security problem instead
Example: Fixing SSL (6)
Plain-text support issues Use SRV records to
1)
enable sites to opt-out from supporting HTTP, then
33 / 33
2) support SRV records in web browsers, and 3) use Strict
Transport Security in the meantime.
33 / 35

34. Stop complaining and solve a security problem instead
Message for today Do one
34 / 33
thing, no matter how small.
Repeat.
34 / 35

35. Stop complaining and solve a security problem instead
Thank you!
The slides will be available for download
from http://blog.ivanristic.com
35 / 35