Encryption can appear to be priceless when it’s absent, as it was in the recent Office of Personnel Management breach. It can appear to be costly when it’s present, as FBI director James Comey has argued. But not everything is as it appears.
Michael Coates, trust and information security officer at Twitter and global board member of the Open Web Application Security Project (OWASP), suggests encryption gets more credit than it deserves.
“Encryption is thrown around as the solution to prevent people from seeing your data,” said Coates in an interview at InformationWeek’s San Francisco office. “But if you dive into the dynamics of how data is stolen, you’ll find that encryption actually is not effective in those scenarios.”
Coates described a scenario involving a database with encrypted information. In order for a Web application to work with that database, it must decrypt the data.
“The way that data is most often compromised is through a vulnerability in the Web application … So when the attacker steals the data, that data will be unencrypted.”
Along these lines, a DHS official has asserted that encryption would not have helped in the OPM breach because the attacker had valid credentials. It may also turn out that encryption’s ability to conceal crime from the authorities is overstated.
Coates stopped by in his OWASP capacity in order to promote the OWASP Application Security Conference, which takes place Sept. 22 through 25 in San Francisco. The aim of the conference is to raise the bar for application security by helping individuals and organizations understand how to build better defended software.
“There’s a definite security talent shortage, so by educating more people we’re hopefully bringing more people into the fold,” said Coates.
Coates hopes the conference will provide companies with specific actions they can take to make their software more secure and with a roadmap to integrate best practices into their software development life cycle.
There are companies doing a good job with security, said Coates, citing Google, Facebook, Mozilla (where he used to work), Netflix, and Twitter (where he currently works). “The challenge is what do you say to the industry at large, to the companies in the Midwest that have one security person. … They can’t hire all these people and build custom solutions.”
Coates agrees with Google and other computer security professionals about the need for access to intrusion software, something could become more difficult if proposed export controls are adopted. “I think security engineers need both [offensive and defensive] skillsets,” he said. “Training someone how to attack software that they need to defend is vital. Anything less than that is just putting blinders on their eyes.”
At the same time, Coates is focused on providing developers with the tools and knowledge to write secure code. “We can’t just run around hacking ourselves secure,” he said. “Instead, we have to say, ‘I understand the symptom, how do I build a solution that is comprehensive and stops this problem from happening again in hundreds of applications?'”
Pointing to the way Java limits buffer overflow errors through array bounds checking and the way Python’s Django framework uses templates to prevent cross-site scripting, Coates expects some help will come through advances in programming languages that limit unsafe coding practices.
But because each application is unique and there are still so many ways to introduce vulnerabilities, Coates is pushing for security training, and for security as part of the software life cycle. “You can’t have security be this other team where you just throw things over the wall and fix stuff,” he said. “That’s a bottleneck and the business grinds to a halt. So you have to have this integrate into the life cycle and have tools that scale, because the cost of human capital for security is really high. And that’s what I see in enterprises that are doing well. They’ve found a way to minimize the human involvement and instead use highly accurate automation.”
Coates recommends that companies implement content security policies for their Web applications to defend against cross-site scripting. He also suggests using SSL everywhere and HSTS (HTTP Strict Transport Security) as defenses against man-in-the-middle attacks. He also advises use of the X-Frame-Options header, to prevent clickjacking (UI redress attacks).
“Fundamental security at the application layer and strong access controls at the enterprise layer governing who can interact with the data, those turn into the bread and butter of security,” said Coates. “And that’s where people need to spend the time.”