Ex-FBI man spills on why hackers are winning the security game

Government and business don't get on, AI is bunk and politics rules


BSidesSF Comfortable illusions about how security is working are crippling the ability of government and industry to fight the threat, a former member of the FBI’s netsec team has told the BSides San Francisco 2017 security conference.

Society is operating under the illusion that governments and corporations are taking rational choices about computer security, but the fact of the matter is that we’re drowning under a sea of false positive, bad management, and a false belief in the power of technology to save us.

“The government is very reactive,” said Jason Truppi, director of endpoint detection and response at security firm Tanium and a former FBI investigator. “Over time we’ve learned it wasn’t working - just being reactive, not proactive.”

Truppi said we need to puncture the belief that government and industry are working together to solve online threats. In reality, he says, the commercial sector and government are working to very different agendas and the result is a hopeless mishmash of confusing loyalties.

On threat intelligence sharing, for example, the government encourages business to share news of vulnerabilities. But the subsequent investigations can be wide-ranging and lead to business' people being charged for unrelated matters. A result companies are increasingly unwilling to share data if it exposes them to wider risks.

The fact of the matter is that companies don’t get their own infosec problems and don’t care that much. Truppi, who has now moved to the commercial sector, said that companies are still trying to hire good network security people, but bog them down in useless false alerts and management panics.

Threat lag

A single false alert can take up days of time, he warned, but upper management - who don’t understand the issues - can tie up days of team time dealing with an alert that isn’t a serious issue. Stock market fraud is a case in point, he said.

The traditional view is that hackers will try to fake stock trades, but Truppi argued that tactic is old hat. It’s much easier, and more profitable, to use insider trading to extract money than trying to fake stock trades that can be checked before the payout.

All it needs is one unsecured endpoint, he said. After that the keys to the palace are open. Compliance rules don’t help much, since they are dealing with yesterday’s threat.

But IT department's incident response (IR) are getting drowned out with false threat information. The result is incident report fatigue, whereby you get so many false positives that the IR team is overwhelmed, and that means they burn out and move to other roles.

Computer security teams move in groups, he opined, and once you lose a key team member you’ll likely lose the whole team. That means you lose all your intellectual reserves, since infosec people seldom share information outside teams.

The big picture

The biggest illusion in computer security is that firms, and government, know what they are doing, Truppi said.

Five years ago everyone assumed that big finance houses knew what they were doing to lock down bank accounts. Now they are playing catchup.

But at least banks are better than most, Truppi opined. Far too many companies think that if they have a disaster recovery plan in place then they’re sorted. But it doesn’t work that way.

We’re only at the start of the distributed denial of service attack stage, he said. We’re going to see major internet outages thanks to botnets of things taking down sections of the internet. How we deal with that will be a deciding factor.

A Mirai-style botnet is coming that could take down the internet for serious periods of time, he warned. And don't expect those fancy AI systems we keep hearing about to have your back. Truppi said they are mostly bunk. ®

Similar topics


Other stories you might like

  • James Webb Space Telescope has arrived at its new home – an orbit almost a million miles from Earth

    Funnily enough, that's where we want to be right now, too

    The James Webb Space Telescope, the largest and most complex space observatory built by NASA, has reached its final destination: L2, the second Sun-Earth Lagrange point, an orbit located about a million miles away.

    Mission control sent instructions to fire the telescope's thrusters at 1400 EST (1900 UTC) on Monday. The small boost increased its speed by about 3.6 miles per hour to send it to L2, where it will orbit the Sun in line with Earth for the foreseeable future. It takes about 180 days to complete an L2 orbit, Amber Straughn, deputy project scientist for Webb Science Communications at NASA's Goddard Space Flight Center, said during a live briefing.

    "Webb, welcome home!" blurted NASA's Administrator Bill Nelson. "Congratulations to the team for all of their hard work ensuring Webb's safe arrival at L2 today. We're one step closer to uncovering the mysteries of the universe. And I can't wait to see Webb's first new views of the universe this summer."

    Continue reading
  • LG promises to make home appliance software upgradeable to take on new tasks

    Kids: empty the dishwasher! We can’t, Dad, it’s updating its OS to handle baked on grime from winter curries

    As the right to repair movement gathers pace, Korea’s LG has decided to make sure that its whitegoods can be upgraded.

    The company today announced a scheme called “Evolving Appliances For You.”

    The plan is sketchy: LG has outlined a scenario in which a customer who moves to a locale with climate markedly different to their previous home could use LG’s ThingQ app to upgrade their clothes dryer with new software that makes the appliance better suited to prevailing conditions and to the kind of fabrics you’d wear in a hotter or colder climes. The drier could also get new hardware to handle its new location. An image distributed by LG shows off the ability to change the tune a dryer plays after it finishes a load.

    Continue reading
  • IBM confirms new mainframe to arrive ‘late’ in first half of 2022

    Hybrid cloud is Big Blue's big bet, but big iron is predicted to bring a welcome revenue boost

    IBM has confirmed that a new model of its Z Series mainframes will arrive “late in the first half” of 2022 and emphasised the new device’s debut as a source of improved revenue for the company’s infrastructure business.

    CFO James Kavanaugh put the release on the roadmap during Big Blue’s Q4 2021 earnings call on Monday. The CFO suggested the new release will make a positive impact on IBM’s revenue, which came in at $16.7 billion for the quarter and $57.35bn for the year. The Q4 number was up 6.5 per cent year on year, the annual number was a $2.2bn jump.

    Kavanaugh mentioned the mainframe because revenue from the big iron was down four points in the quarter, a dip that Big Blue attributed to the fact that its last mainframe – the Z15 – emerged in 2019 and the sales cycle has naturally ebbed after eleven quarters of sales. But what a sales cycle it was: IBM says the Z15 has done better than its predecessor and seen shipments that can power more MIPS (Millions of Instructions Per Second) than in any previous program in the company’s history*.

    Continue reading

Biting the hand that feeds IT © 1998–2022