6 ms·

Data is a Toxic Asset

180 points by interweb 11y ago

whatnotests 11y ago
Securing data is a daunting state to be in; it's not a task, but a lifestyle. Out of 100 average web developers only a handful take security into account during design and fewer still think and work through what's necessary to keep anything safe at all. It's no wonder that popping servers is so trivial and even high value targets with dedicated security teams and constant proactive threat response get pw0nd daily.
- x5n1 11y ago
  It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. You want a full-stack developer that also deal with security, as they say good luck with that. Knowledge in web development is always incomplete because there is simply not enough time to learn everything. So web developers and software developers are necessarily hackers. All of them. It is impossible for a software developer to be an expert because the domain of knowledge is beyond an individual's comprehension. So good luck adding security to the repertoire of already overworked people who are doing the jobs of 3 different people and usually earning a pittance for all the work they are doing. You want security, then hire a security expert to oversee the development and ensure security. Pay him or her 60,000-70,000 to ensure that. Otherwise forget about it, not going to happen. Your developer is already too busy as he or she is.
  - CaptSpify 11y ago
    > It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. ?por que no los dos? I agree that the stack is crazy-huge these days, and shifting too much to solidly learn everything. We should still expect devs to try and integrate security through the entire thing though
    - x5n1 11y ago
      Sorry but your expectation will not be met. You might be able to get better security, like for instance avoid SQL injections but it's a question of whether you think security is an all or none game. That either it's totally secure or a few known well known attacks are usually mitigated. A few attacks, sure. Secure. I don't think so. The attack surface is too large and the timelines too short to ensure anything other than, it works. Just like we do QA you need security reviews that follow QA, a security team needs to review the code for just that security. Some of it can be automated, other stuff needs to be carefully studied. You can expect to add 20-30% to the final cost to account for something like this.
  - vbezhenar 11y ago
    Security is easy. Do not trust user input. In any framework or library just identify user inputs and treat them carefully. Hard part is to remember that.
    - voltagex_ 11y ago
      No, no it's really not. https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 and that's only Web security.
      - vbezhenar 11y ago
        Almost all of those items are exactly what I wrote: do not trust user input.
        voltagex_ 11y ago
        There has to be a middle ground between saying "security is simple" and "the sky is falling". I think stating things like "don't trust user input" risks things like https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.html https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... happening. Security is hard, programming is hard, we should all get better at both.
        deleted 11y ago
        [deleted]
        x5n1 11y ago
        Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permission on a site (for instance, after they successfully login).
    - Terr_ 11y ago
      Requirements from clients are also a form of untrustworthy input :)
- _delirium 11y ago
  It's not only the software developer side, but also the business side that doesn't take it seriously. Businesses currently see only the upside in aggregating ever-larger pools of crosslinked data. Schneier's article here is pointing out the downside: collecting big centralized pools of data is an accident waiting to happen, a giant pile of toxic waste stored in rusty drums, which businesses are happily piling more waste onto as fast as they can.
  - craigmccaskill 11y ago
    More than that but there's no regulatory push (outside of maybe healthcare?) to require stringent handling of peoples data. If anything the opposite is true where the government wants people to build a specific backdoor for them. This is certainly one of the reasons I've become more aware recently of the amount of data certain companies have on me. Data breaches have the potential to be catastrophic and very few people are looking out for my best interests.
- pbreit 11y ago
  Shouldn't this be fairly standardized and easy by now?
  - pdkl95 11y ago
    You can't standardize vigilance.
- XorNot 11y ago
  Part of this is our fault in implementing security libraries though. Let's face it: SSL has a terrible user experience when it doesn't work. While "just fail" is good practice, it's way too difficult to use in development across multiple languages compared to just using unencrypted traffic.
jmaistre 11y ago
The Ashley Madison data breach was such a disaster for the company because it saved its customers' real names and credit card numbers. It didn't have to do it this way. It could have processed the credit card information, given the user access, and then deleted all identifying information. To be sure, it would have been a different company. It would have had less revenue, because it couldn't charge users a monthly recurring fee. This seems to me the wrong way to solve the problem. The crazy thing about credit cards, social security numbers, and bank account numbers is that these numbers are supposed to be kept secret and private, and yet you need to constantly give them out to people. Everyone you write a check to gets your bank account number, every place you buy from gets a credit card number. This is insane. The right way to solve this is that Visa and Master Card need to develop a standard to make super easy to generate a unique payment number everytime you make an online purchase. Then that should be built in as a browser extension or component. So I browse to a site, click to pay with my Visa card, and Visa automatically generates a unique code for that site and fills it in on the form. Also it is insane that someone can steal my identity by simply knowing my social security card. The right way to solve this would be to have an indentity provider that has a short 10 second video of myself on file. Then, when I want to sign up for a credit card or bank account, I take a 10 second video of myself using my cell phone, granting approval to open the account. A staffer at the credit card company then compares the video with the video on file with the identity provider, and verifies that it matches. The identify provider also sends a message to an email address or mobile number on file, so that I am alerted that someone is opening an account in my name. Using these two simple safe guards, identity theft would be much, much harder. A video recording of a person is very hard to fake, much harder to fake than a signature. A final key innovation would be if email providers would make it super-easy to generate aliases per site. I do this myself manually with fastmail, but if there was a simple browser extension that would automatically create an alias and fill in a form, that would be great, because I could have a unique address that all funnels into one place, for everything I sign up to.
- icebraining 11y ago
  Around here, the local payment system is inverted: the site generates a code for your order, and the user instructs their own bank to send money to that code. That said, many banks - including in the US - can already generate single-use virtual CC numbers.
makeitsuckless 11y ago
Schneier is missing one major reason why companies keep data: regulation. So many regulatory bodies and laws requiring companies to keep all kinds of data for all kinds of reasons for a wide variety of periods, so that simply having a policy to "store all the things" is way, way simpler to implement than to carefully study and adhere to each individual rule. Nothing really new here, even before cheap storage and ubiquitous computers, companies kept boxes and boxes of all the paperwork ever, just in case some audit may require them to dig it up. Only physical limitations sometimes caused them to throw away stuff labeled "a decade ago", and today there simply is more data and zero incentive to destroy it.
- aethertron 11y ago
  Good point, here's an example: EU VAT, which obliges companies selling digital goods in Europe to store customer and transaction details for 10 years. https://www.gov.uk/guidance/register-and-use-the-vat-mini-one-stop-shop#records-you-need-to-keep https://www.gov.uk/guidance/register-and-use-the-vat-mini-on...
  - ross-life 11y ago
    How does this work with digital stores (Steam/App Store/Play Store)? Do you even get that data from them as a developer?
    - aethertron 11y ago
      I think those stores take care of VAT and all the requirements around that, so the developer doesn't need to worry about it. That's what the 30% cut is for.
- hvindin 11y ago
  Buy the concept of taking data offline or to another network applies to this. For example, while banks are required to keep tons of data for legal reason, the ones I've worked with have procedures where, for example, tellers are required to shred everything and send it for incineration. Then, the digital copies, once they can only be required if theres legal compulsion going on (ie after x number of years), are transfered by batch jobs which encrypt everything with a key generated by a CA that is offline most of the time, to a tape library which is only online for batch writes and can only be brought online manually by physically going into the data center. Then, after a little more time, but still within legally required reporting periods, the tapes are moved into a warehouse which very much resembles a bank vault. And as soon as theres a reason that the data isnt mandatorily kept, the tapes are destroyed. Honestly the security around those tapes is higher than bricks of cash, and they're destroyed even more readily.
jjwiseman 11y ago
Maciej Ceglowski has been saying the same thing: http://idlewords.com/talks/haunted_by_data.htm http://idlewords.com/talks/haunted_by_data.htm
KirinDave 11y ago
He's right that data volumes have non-linear risk profiles. He's wrong that there is evidence more data isn't better. While there are indications of this for advertising, it is definitely not the case for financial data. And the other subtlety is that lots of low quality data is indeed useless, but small sums of high value data can do a lot. That high value data is what people are looking to steal. Having a little bit of user financial traction data, for example, is incredibly powerful. Much more so than, say, cross-website shared cookies or Amazon referral patterns. And there is a whole class of data that has value proportional to the total sum of it you possess. A good example of that is surveillance data. Ubiquitous video coverage of an environment is much more useful (to both machines and humans) than partial coverage.
CM30 11y ago
Or in the simplest terms possible, the best 'private' service or site is the one that doesn't store any personal information for its users. If you're running a site like Ashley Madison, then don't store real names and information. Same with if you're running an anonymous message service, an anonymous emai service, etc. That's not some shocking new thing. Forums and other such sites have been letting people sign up with no more than an email address and password for years. And the payment stuff on these sites and services could easily go through PayPal or some other third party provider (who's likely got a much more secure system setup than you). But no, a lot of sites and companies and services seem to be all 'let's store everything about everyone, and then wonder why it causes a meltdown when the site gets hacked and said data leaked all over the internet'.
stretchwithme 11y ago
I'd like to see 2 or 3 or 4 step authentication in place whenever someone tries to USE my data. Your data is over the place, in many hands. While it should be protected, it should also be much harder to use it to pretend to be you. You should be able to set up 0 or 1 or 2 step authentication for trivial purchases, 3 step for larger purchases or accessing credit, or even 4 step authentication for things like buying a car or house. Some steps could be approval require or denial required. Its enough to be able to deny the purchase of a latte, but you might want to always have to approve spending thousands of dollars. And we need to be able to set up new kinds of authentication steps, like fingerprints or the approval of one or more trusted relatives for an older person or child. Or even use a notary public. And you might have to use more of these if you are from home. And none of this should be manditory, but there should be sensible defaults that individuals can change. AFTER being well authenticated, of course :-) If we raise the difficulty level of stealing MOST people's identity, this will largely solve this problem, especially for those most wanting to solve it.
rl3 11y ago
The trick is to just collect and store data at exabyte scales like Google or the NSA. That way when there's a breach, it's impractical for the attackers to exfiltrate the complete dataset because the target probably represents a non-trivial percentage of the world's storage capacity. The attackers can filter the data, but surely someone's going to notice ten thousand machines whirring away at odd MapReduce queries.
- Terribledactyl 11y ago
  Let's say all of the most sensitive data of a person can be fit in 20kb, SSN, CC, Bank, your dogs's high school's mascot's sweetheart, etc. The entire US would just about fit on a 6tb drive. The rest of the data is not that valuable in comparison.
  - rl3 11y ago
    >your dogs's high school's mascot's sweetheart I'm not sure what that is exactly, but it sounds really sensitive. :) In all seriousness, while the release of banking and identity information is certainly bad, I'd argue the contents of private communications or browsing/search history are potentially far more damaging for a lot of people. In order to include that in your hypothetical, it'd require either a lot of filtering or the 6TB number would balloon quite a bit.
    - Terribledactyl 11y ago
      >I'm not sure what that is exactly, but it sounds really sensitive. I was poking fun at "security" questions. These bits of data are gatekeepers, if I have your aol account password, I get all of those for free. (So I think we're in agreement, my SSN isn't controversial to my friends, employer, family, news, etc, but most people have probably had conversations or searches that could look really bad)
zmmmmm 11y ago
This is a great article, and I hope it gets read widely. I love the phrase "toxic data spill". We won't have reached maturity in the IT world until it becomes completely accepted and assumed that your systems will be broken into and whatever data is accessible there will be stolen. Only when we start designing with that in mind as a first principle will we actually have a chance of making people safe. For now, virtually every system I come across is designed around the principle that nobody bad will ever get in, and all we have to focus on is layers of encryption and network security to stop them - it is honestly just ludicrously naive. Even with perfect security, one day someone you let in will turn bad and expose data.
deleted 11y ago
[deleted]

180 points by interweb 11y ago

Securing data is a daunting state to be in; it's not a task, but a lifestyle. Out of 100 average web developers only a handful take security into account during design and fewer still think and work through what's necessary to keep anything safe at all. It's no wonder that popping servers is so trivial and even high value targets with dedicated security teams and constant proactive threat response get pw0nd daily.

x5n1 11y ago
It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. You want a full-stack developer that also deal with security, as they say good luck with that. Knowledge in web development is always incomplete because there is simply not enough time to learn everything. So web developers and software developers are necessarily hackers. All of them. It is impossible for a software developer to be an expert because the domain of knowledge is beyond an individual's comprehension. So good luck adding security to the repertoire of already overworked people who are doing the jobs of 3 different people and usually earning a pittance for all the work they are doing. You want security, then hire a security expert to oversee the development and ensure security. Pay him or her 60,000-70,000 to ensure that. Otherwise forget about it, not going to happen. Your developer is already too busy as he or she is.
- CaptSpify 11y ago
  > It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. ?por que no los dos? I agree that the stack is crazy-huge these days, and shifting too much to solidly learn everything. We should still expect devs to try and integrate security through the entire thing though
  - x5n1 11y ago
    Sorry but your expectation will not be met. You might be able to get better security, like for instance avoid SQL injections but it's a question of whether you think security is an all or none game. That either it's totally secure or a few known well known attacks are usually mitigated. A few attacks, sure. Secure. I don't think so. The attack surface is too large and the timelines too short to ensure anything other than, it works. Just like we do QA you need security reviews that follow QA, a security team needs to review the code for just that security. Some of it can be automated, other stuff needs to be carefully studied. You can expect to add 20-30% to the final cost to account for something like this.
- vbezhenar 11y ago
  Security is easy. Do not trust user input. In any framework or library just identify user inputs and treat them carefully. Hard part is to remember that.
  - voltagex_ 11y ago
    No, no it's really not. https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 and that's only Web security.
    - vbezhenar 11y ago
      Almost all of those items are exactly what I wrote: do not trust user input.
      - voltagex_ 11y ago
        There has to be a middle ground between saying "security is simple" and "the sky is falling". I think stating things like "don't trust user input" risks things like https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.html https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... happening. Security is hard, programming is hard, we should all get better at both.
      - deleted 11y ago
        [deleted]
      - x5n1 11y ago
        Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permission on a site (for instance, after they successfully login).
  - Terr_ 11y ago
    Requirements from clients are also a form of untrustworthy input :)
_delirium 11y ago
It's not only the software developer side, but also the business side that doesn't take it seriously. Businesses currently see only the upside in aggregating ever-larger pools of crosslinked data. Schneier's article here is pointing out the downside: collecting big centralized pools of data is an accident waiting to happen, a giant pile of toxic waste stored in rusty drums, which businesses are happily piling more waste onto as fast as they can.
- craigmccaskill 11y ago
  More than that but there's no regulatory push (outside of maybe healthcare?) to require stringent handling of peoples data. If anything the opposite is true where the government wants people to build a specific backdoor for them. This is certainly one of the reasons I've become more aware recently of the amount of data certain companies have on me. Data breaches have the potential to be catastrophic and very few people are looking out for my best interests.
pbreit 11y ago
Shouldn't this be fairly standardized and easy by now?
- pdkl95 11y ago
  You can't standardize vigilance.
XorNot 11y ago
Part of this is our fault in implementing security libraries though. Let's face it: SSL has a terrible user experience when it doesn't work. While "just fail" is good practice, it's way too difficult to use in development across multiple languages compared to just using unencrypted traffic.

jmaistre 11y ago

The Ashley Madison data breach was such a disaster for the company because it saved its customers' real names and credit card numbers. It didn't have to do it this way. It could have processed the credit card information, given the user access, and then deleted all identifying information. To be sure, it would have been a different company. It would have had less revenue, because it couldn't charge users a monthly recurring fee. This seems to me the wrong way to solve the problem. The crazy thing about credit cards, social security numbers, and bank account numbers is that these numbers are supposed to be kept secret and private, and yet you need to constantly give them out to people. Everyone you write a check to gets your bank account number, every place you buy from gets a credit card number. This is insane. The right way to solve this is that Visa and Master Card need to develop a standard to make super easy to generate a unique payment number everytime you make an online purchase. Then that should be built in as a browser extension or component. So I browse to a site, click to pay with my Visa card, and Visa automatically generates a unique code for that site and fills it in on the form. Also it is insane that someone can steal my identity by simply knowing my social security card. The right way to solve this would be to have an indentity provider that has a short 10 second video of myself on file. Then, when I want to sign up for a credit card or bank account, I take a 10 second video of myself using my cell phone, granting approval to open the account. A staffer at the credit card company then compares the video with the video on file with the identity provider, and verifies that it matches. The identify provider also sends a message to an email address or mobile number on file, so that I am alerted that someone is opening an account in my name. Using these two simple safe guards, identity theft would be much, much harder. A video recording of a person is very hard to fake, much harder to fake than a signature. A final key innovation would be if email providers would make it super-easy to generate aliases per site. I do this myself manually with fastmail, but if there was a simple browser extension that would automatically create an alias and fill in a form, that would be great, because I could have a unique address that all funnels into one place, for everything I sign up to.

icebraining 11y ago
Around here, the local payment system is inverted: the site generates a code for your order, and the user instructs their own bank to send money to that code. That said, many banks - including in the US - can already generate single-use virtual CC numbers.

makeitsuckless 11y ago

Schneier is missing one major reason why companies keep data: regulation. So many regulatory bodies and laws requiring companies to keep all kinds of data for all kinds of reasons for a wide variety of periods, so that simply having a policy to "store all the things" is way, way simpler to implement than to carefully study and adhere to each individual rule. Nothing really new here, even before cheap storage and ubiquitous computers, companies kept boxes and boxes of all the paperwork ever, just in case some audit may require them to dig it up. Only physical limitations sometimes caused them to throw away stuff labeled "a decade ago", and today there simply is more data and zero incentive to destroy it.

aethertron 11y ago
Good point, here's an example: EU VAT, which obliges companies selling digital goods in Europe to store customer and transaction details for 10 years. https://www.gov.uk/guidance/register-and-use-the-vat-mini-one-stop-shop#records-you-need-to-keep https://www.gov.uk/guidance/register-and-use-the-vat-mini-on...
- ross-life 11y ago
  How does this work with digital stores (Steam/App Store/Play Store)? Do you even get that data from them as a developer?
  - aethertron 11y ago
    I think those stores take care of VAT and all the requirements around that, so the developer doesn't need to worry about it. That's what the 30% cut is for.
hvindin 11y ago
Buy the concept of taking data offline or to another network applies to this. For example, while banks are required to keep tons of data for legal reason, the ones I've worked with have procedures where, for example, tellers are required to shred everything and send it for incineration. Then, the digital copies, once they can only be required if theres legal compulsion going on (ie after x number of years), are transfered by batch jobs which encrypt everything with a key generated by a CA that is offline most of the time, to a tape library which is only online for batch writes and can only be brought online manually by physically going into the data center. Then, after a little more time, but still within legally required reporting periods, the tapes are moved into a warehouse which very much resembles a bank vault. And as soon as theres a reason that the data isnt mandatorily kept, the tapes are destroyed. Honestly the security around those tapes is higher than bricks of cash, and they're destroyed even more readily.

jjwiseman 11y ago

Maciej Ceglowski has been saying the same thing: http://idlewords.com/talks/haunted_by_data.htm http://idlewords.com/talks/haunted_by_data.htm

KirinDave 11y ago

He's right that data volumes have non-linear risk profiles. He's wrong that there is evidence more data isn't better. While there are indications of this for advertising, it is definitely not the case for financial data. And the other subtlety is that lots of low quality data is indeed useless, but small sums of high value data can do a lot. That high value data is what people are looking to steal. Having a little bit of user financial traction data, for example, is incredibly powerful. Much more so than, say, cross-website shared cookies or Amazon referral patterns. And there is a whole class of data that has value proportional to the total sum of it you possess. A good example of that is surveillance data. Ubiquitous video coverage of an environment is much more useful (to both machines and humans) than partial coverage.

CM30 11y ago

Or in the simplest terms possible, the best 'private' service or site is the one that doesn't store any personal information for its users. If you're running a site like Ashley Madison, then don't store real names and information. Same with if you're running an anonymous message service, an anonymous emai service, etc. That's not some shocking new thing. Forums and other such sites have been letting people sign up with no more than an email address and password for years. And the payment stuff on these sites and services could easily go through PayPal or some other third party provider (who's likely got a much more secure system setup than you). But no, a lot of sites and companies and services seem to be all 'let's store everything about everyone, and then wonder why it causes a meltdown when the site gets hacked and said data leaked all over the internet'.

stretchwithme 11y ago

I'd like to see 2 or 3 or 4 step authentication in place whenever someone tries to USE my data. Your data is over the place, in many hands. While it should be protected, it should also be much harder to use it to pretend to be you. You should be able to set up 0 or 1 or 2 step authentication for trivial purchases, 3 step for larger purchases or accessing credit, or even 4 step authentication for things like buying a car or house. Some steps could be approval require or denial required. Its enough to be able to deny the purchase of a latte, but you might want to always have to approve spending thousands of dollars. And we need to be able to set up new kinds of authentication steps, like fingerprints or the approval of one or more trusted relatives for an older person or child. Or even use a notary public. And you might have to use more of these if you are from home. And none of this should be manditory, but there should be sensible defaults that individuals can change. AFTER being well authenticated, of course :-) If we raise the difficulty level of stealing MOST people's identity, this will largely solve this problem, especially for those most wanting to solve it.

rl3 11y ago

The trick is to just collect and store data at exabyte scales like Google or the NSA. That way when there's a breach, it's impractical for the attackers to exfiltrate the complete dataset because the target probably represents a non-trivial percentage of the world's storage capacity. The attackers can filter the data, but surely someone's going to notice ten thousand machines whirring away at odd MapReduce queries.

Terribledactyl 11y ago
Let's say all of the most sensitive data of a person can be fit in 20kb, SSN, CC, Bank, your dogs's high school's mascot's sweetheart, etc. The entire US would just about fit on a 6tb drive. The rest of the data is not that valuable in comparison.
- rl3 11y ago
  >your dogs's high school's mascot's sweetheart I'm not sure what that is exactly, but it sounds really sensitive. :) In all seriousness, while the release of banking and identity information is certainly bad, I'd argue the contents of private communications or browsing/search history are potentially far more damaging for a lot of people. In order to include that in your hypothetical, it'd require either a lot of filtering or the 6TB number would balloon quite a bit.
  - Terribledactyl 11y ago
    >I'm not sure what that is exactly, but it sounds really sensitive. I was poking fun at "security" questions. These bits of data are gatekeepers, if I have your aol account password, I get all of those for free. (So I think we're in agreement, my SSN isn't controversial to my friends, employer, family, news, etc, but most people have probably had conversations or searches that could look really bad)

zmmmmm 11y ago

This is a great article, and I hope it gets read widely. I love the phrase "toxic data spill". We won't have reached maturity in the IT world until it becomes completely accepted and assumed that your systems will be broken into and whatever data is accessible there will be stolen. Only when we start designing with that in mind as a first principle will we actually have a chance of making people safe. For now, virtually every system I come across is designed around the principle that nobody bad will ever get in, and all we have to focus on is layers of encryption and network security to stop them - it is honestly just ludicrously naive. Even with perfect security, one day someone you let in will turn bad and expose data.

deleted 11y ago

[deleted]