Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3435

Re: Is computer security culture simply broken?

Show all headers | View raw

On 2014-05-25, Rich <rich@example.invalid> wrote:
> Randy Westlund <Vorzakir@invalid.invalid> wrote:
>
>> I don't understand why no one can do this properly.  Salt and hash,
>> it's really not that hard!
>
> Hmm...  Some guesses:
>
> 1) school has changed from teaching "how to think" into teaching "how
>    to memorize standardized answers";

That's true of the Microsoft Certification malarkey.  I was reluctantly
pushed onto a course for one of those exams and the course instructor
recommended that on top of an already expensive course we buy sets of
typical questions to practice on.  He then recommended one in particular
and proudly stated that out of the $150 or so it cost, he'd get $50.

The advice I received from others who had done this before was to stock up
on practice questions and learn them by rote, "because there's
insufficient time in the exam to think about each answer".

The whole experience left me with a very nasty taste in my mouth.

> 2) most individuals do not in any way, shape, or form, possess the
>    "security mindset"
>    (https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html);

Hehe.  I think I do possess that mindset (though maybe not as acutely as
Bruce), and I put it down to a fascination with "what if?" constructs.

For example when I first read a description of Curiosity's Mars landing
my first thoughts as each step of the procedure automatically focussed on
what could go wrong, for example "what if just one of those explosive bolts
failed to go off or jammed?".

> 3) because of #1, no school even addresses the "security mindset"
>    angle, because to do so would be to attempt to teach how to think
>    and how to solve unknown problems;

The emphasis at my school (a long time ago of course) was to question
stuff. I am pretty sure that such an environment fosters an enquiring mind.

> 4) ignorance (much as a result of 1-3 above) on the part of most dev's;
>
> 5) just not caring, or worse, thinking "I'll work on that later, but
>    right now I've got to get _something_ working;

I once did a stint at a company that boasted that they used "software
prototyping" to good effect.  Some unfinished stuff definitely did find
its way into production (I had to sort it out), but they were very
profitable. "Publish and be damned" seemed to work for them, and then
they had the money in the bank to pay folks like me to sort out the mess.

> 6) ... ???

Back to point 1) really.  The various certification systems out there
attract a lot of parasites who are more interested in the money that actual
teaching.  And there is a lot of money in it.  Since my experience of that
MS certification course every time I hear the word "incentive" I go through
the mental exercise of seeing whether "back hander" is a better description.


-- 
Paul Sture

The final step of #heartbleed recovery is to call your mother, and advise
her to change her maiden name                                  -- @gojomo

Back to comp.misc | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web