Stepping Up Our Game: Re-focusing the Security Community on Defense and Making Security Work for Everyone

Alex Stamos, CSO, Facebook twitter
Black Hat USA 2017
💬 abstract 📹️ video

This talk is a nice blend of:

• Reminiscing about the past, the early days of the security community.

• A frank discussion of some ways the security community isn’t living up to its potential in making the world a better and safer place.

• Some recommendations on what should be focused on going forward.

• A rousing call to action and an optimistic vision of the future.

The World Has Changed

Times have changed, but the community and industry has not. We haven’t changed our attitude towards what kind of responsibility that puts on us.

Three Ways the Infosec Community Can Improve

1. We focus on complexity, not harm

We glorify the complexity of a hack, when in reality attackers will do the simplest thing that works.

The vast majority of actual human harm occurs outside of the space we generally consider “infosec”: abuse; that is, using legitimate features to cause harm. Doxxing, for example.

The day-to-day issues that cause people’s privacy to be violated are generally not technically complex (e.g password reuse). They’re the issues we’ve had for decades.

2. Our field punishes imperfect solutions in an imperfect world

The modern technology landscape requires people to walk on tightropes, and we haven’t built users a safety net. “Don’t click that link/open that doc. Cert warning? Just use your knowledge of X509 to know if it’s safe.”

We have a problem with empathy- “I found where the problem is, it’s between the chair and the keyboard.” This is dangerous, because it makes it easy to shift the responsibility of building trustworthy, dependable systems onto other people.

Every day we make billions of people walk these tightropes, and if they fall off, we say we can do nothing to help them.

A common affliction in the infosec community. But let’s be realistic - most people aren’t being targeted by advanced nation state actors, and oftentimes making small compromises to make something massively more widespread (e.g. end-to-end encryption) can meaningfully raise the security bar.

3. We don’t engage the world effectively

Both developers as well as at a geopolitical level.

A recent intense period of debate about encryption was the Department of Justice vs. Apple case after the San Bernadino terrorist attacks. While there was some good, well-reasoned criticism of the government’s views by advocacy groups, tech companies, and academic papers, there were many more hot takes on Twitter from security professionals calling government officials stupid and/or evil.

To a number of infosec professionals, they assumed that if someone wants a solution to the “encryption problem,” it must be because they don’t understand how crypto works, they don’t understand math, haven’t though about it deeply, or because it’s part of some mass surveillance conspiracy.

The infosec community’s views on encryption aren’t always obvious to people with different backgrounds. Coming from a different community, the trade-offs can look quite different.

As the Facebook CISO, part of Alex’s job is to go around the world and engage with government and law enforcement. Like infosec, law enforcement is kind of like a family, a profession with a real sense of community.

One conference he’s been to several times is the Crimes Against Children Conference. Not exactly the most uplifting subject matter, but it is uplifting to attend and see thousands of people who have dedicated their lives to protecting children against abuse in the physical world and online.

As a community, we need to have empathy with people who disagree with us.

Doing this will allow our voices to actually be heard and demonstrate that we are adults willing to engage in a difficult topic.

What the Infosec Community Should Do Going Forward

1. Focus more of our attention and innovation on defense

Facebook is putting up $1 million in 2018 for the best new defensive research in the Internet Defense Prize.

2. We need to broaden what we consider our responsibility

A huge amount of harm comes from areas outside what we traditionally consider our domain, and unfortunately they don’t easily fall under other people’s domains either.

The best people to work on these problems is us, as we’ve spent decades thinking about how technology can be subverted and abused.

Alex and several of his colleagues wrote a whitepaper about Facebook’s observations about the U.S. 2016 election and more broadly what a modern information campaign looks like that attempts to subvert another country’s democracy using technical means.

To properly handle these threats, we need to leverage people’s expertise from other domains.

3. We need to support the diversity of people, backgrounds, and thoughts in the infosec community

The members of the security community need to be representative of the types of people we need to protect. This is the only way we can foresee the challenges people are going to have with technology and understand which solutions are actually possible in a specific cultural situation.

For example, when you’re doing election security, it’s incredibly useful to have people with degrees in international relations or foreign service, and the use cases and threat models of someone building a product in the Bay Area is totally different from someone using it in a small town in India.

4. We need to retain the talent we already have

One way to create an environment that’s open and welcoming to diverse people and diverse viewpoints is to diversify the management team. This helps with finding talent as well as providing an example for how you can raise through the ranks even if you’re new to the field.

Every one of us has an important power - the power of inclusion.

By making people feel included in conversations and at cons, we build them up, giving them experiences and knowledge that’s beneficial for their career and makes them powerful and valuable to the world in the future.

Our collective behavior determines who feels welcome in the infosec community, and thus who are going to be our colleagues over the next several decades. If you’re about to make a snide comment to someone, think if that will make them feel like they don’t belong in our community.

Call to Action

The keynote ends with the following call to action (note: slightly edited/condensed):

Stay in Touch!

If you have any feedback, questions, or comments about this post, please reach out! We’d love to chat.