Snake Oil Won’t Cure Your Security Illness

Part two in a three-part series about the information security industry money grab.

Introduction

NOTE: I covered some of these issues in my book; Unsecurity: Information Security Is Failing. Breaches Are Epidemic. How Can We Fix This Broken Industry?

In this series, I’ll focus on three types of money grabbers, those

  1. Who will do anything and everything for your money
  2. Those who sell snake oil
  3. Those who will sell you something regardless of it’s effects on your security.

There’s no doubt that the money grab is alive and well in the information security industry. Some companies and people in our industry will do everything they can to get their hands on your money. Some of them should get your money, while others should be put out of business because of their deceptive practices.

Clark Stanley’s Snake Oil

This stuff was amazing. A concoction, or “liniment” as Clark Stanley called it, that will cure just about anything; rheumatism, neuralgia, sciatica, “lame back”, lumbago, “contracted cords”, toothaches, sprains, swelling, etc. I don’t even know what half these ailments are, but I don’t know if I’d care either. This stuff will cure me of ailments I don’t even know I have, and it will protect me from future ailments. If I were alive in the 1890s, I might have bought some of this wonder juice.

When Clark Stanley started peddling his snake oil to the ignorant masses, there was nothing to stop him. There was no regulation to govern the safety and effectiveness of drugs until 1906. Nobody even knew what Mr. Stanley’s wonder-drug was made of until 1916, this was the year that the Bureau of Chemistry (later the Food and Drug Administration-FDA) tested Snake Oil and determined it was made from mineral oil, 1% fatty oil (assumed to be tallow), capsaicin from chili peppers, turpentine, and camphor.

People caught on, the jig was up, and Stanley eventually pled no contest to federal civil charges that were leveled against him.

Information security industry snake oil

There’s snake oil for sale in our industry. Don’t buy it. It doesn’t work (for you).

Thanks in large part to Clark Stanley, the term “snake oil” has become synonymous with products and services that provide little (if any) value, but are promoted as solutions to problems. The term is also used to refer to exaggerated claims made by salespeople.

You’d be naïve to think there aren’t products and services sold in our industry that don’t fit our definition of “snake oil”. There are two types of snake oil being peddled today, the kind that is overtly deceptive and the kind the covertly deceptive. Both are bad, and you need to watch out.

Overtly deceptive

Overtly deceptive snake oil is the kind that comes with claims that are so outrageous, you start to question everything you know about yourself. The claims seem so real, with seemingly genuine evidence, and fancy words, you ask yourself questions like “Could this possibly be true?” “Is everything I’ve known about these things been wrong?” “How could I be so wrong?” “Is my existence a joke?”

No, you’re not wrong. Your existence is not a joke. The claims are crazy.

Here are two recent examples.

World’s First Patented Unhackable Computer Ever

What?! Unhackable? This can’t possibly be true. Can it? Well, if we were to believe Pritam Nath, the CEO of MicrosafeX Company, then yes it is true. If you use your noggin and think about this for a minute, the answer is absolutely NOT! There is no “unhackable” computer. There is no “unhackable” anything. Mr. Nath is selling snake oil, and thankfully the jig was up before people fell for it.

You should read his claims on his Kickstarter fundraising page. The claims are laughable if they weren’t so sad and patently false. There were 36 reported “backers” of Mr. Nath’s snake oil before the campaign was cancelled. I’m guessing most of these people were in it for the fun, not because they took this thing seriously.

Time AI

Sounds cool. What is it?

AI is sexy, but if AI doesn’t get your juices flowing, how about “quasi-prime numbers”, “infinite wave conjugations,” and “non-factor based dynamic encryption and innovative new developments in AI”?

SOLD! Lots a big words solving cool problems that I don’t understand. Must be cutting edge stuff.

The company peddling this Time AI thingy is Crown Sterling out of Newport Beach, California. I’d never even heard of these guys before last week.

Last week, at Black Hat, Robert Edward Grant, the company’s Founder, Chairman, and CEO gave a talk titled “The 2019 Discovery of Quasi-Prime Numbers: What Does This Mean For Encryption?“. The talk was so overtly snake oilish that it prompted very strong reactions (outrage) from some people who were there.

Dan Guido, the CEO of Trail of Bits stood up during Mr. Grant’s snake oil pitch and shouted “Get off the stage, you shouldn’t be here!” “You should be ashamed of yourself!” Ballsy.

Here’s a video clip of the exchange.

Jean-Philippe Aumasson is a serious crypto guy, and the author of the book Serious Cryptography.

There was enough of an uproar to force changes at Black Hat, including removal of references to the talk from the conference website and a promise of better vetting of sponsored talks in the future.

More coverage:

These are two examples of obvious and overtly deceptive snake oil. There’s also the less obvious, covertly deceptive variety.

Covertly deceptive

Covertly deceptive snake oil is hard for the inexperienced and/or lazy security professional to identify. It’s the sort of snake oil where a salesperson or company claims that their product does something that it doesn’t or that it will solve a problem, but it won’t. This snake oil is hard to identify because you won’t know unless you know.

One tell for covertly deceptive snake oil is the prominent use of sexy buzzwords. Common sexy buzzwords/phrases include:

  • Artificial intelligence or “AI”
  • Blockchain
  • Digital transformation
  • Big data
  • Machine learning or “ML”
  • Nextgen
  • Data-driven

If someone uses a buzzword or phrase that you don’t understand, go find out what it means. Don’t just sit there and nod your head like you know. Discounting buzzwords and phrases won’t always work though. There are legitimate companies and products in the market using sexy buzzwords, but work as promised.

The key to protecting against covertly deceptive snake oil is to follow the advice in the closing (below); research, educate, and/or ask. Don’t ever rely solely on the opinions and research provided by the company or salesperson who’s selling, it’s biased.

Buyer beware

It’s you who makes buying decisions for you. No pressure, but every dollar you spend on security is one less dollar your organization can spend on fulfilling its mission, so you should get it right.

Don’t ever buy anything without doing one (or all three) of the following:

  1. Conduct in-depth research into the product and how it works.
  2. Educate yourself on the technology the product claims to use.
  3. Ask an unbiased expert for his/her opinion.

If we all made good purchasing decisions, the snake oil will dry up. You will need to do more work, but in the end it will save you.

Beware of People Who Do Everything

Part one in a three-part series about the information security industry money grab.

Introduction

NOTE: I covered some of these issues in my book; Unsecurity: Information Security Is Failing. Breaches Are Epidemic. How Can We Fix This Broken Industry?

In this series, I’ll focus on three types of money grabbers:

  1. Those who will do anything and everything for your money,
  2. Those who sell snake oil, and
  3. Those who will sell you something regardless of its effects on your security.

Sometimes the money grabbers grab your money intentionally, but rarely do they do it with malicious intent.

There’s no doubt that the money grab is alive and well in the information security industry. We’re in the midst of the Cybersecurity gold rush, and there are thousands of companies fighting for their piece of your pie.

Cybersecurity gold rush

First, a quick comparison between the famous California gold rush and our cybersecurity gold rush.

The California gold rush looked like this: $10 million in 1849, $41 million in 1850, $75 million in 1851, and $81 million in 1852 (peak). After 1852, the rush gradually declined until 1857, then leveled to about $45 million per year.

The cybersecurity gold rush looks like this: $3.5 billion in 2004, $114 billion in 2018, $124 billion in 2019, and $170 billion by 2022. We haven’t exactly leveled off yet, but that day will come.

The truth about the cybersecurity gold rush; if you’re not one who’s making money, you’re probably one who’s spending it.

Spending well or not

Ask yourself these questions:

  • How confident am I that I’m spending my information security dollars wisely?
  • Am I getting the most value out of every dollar I spend?
  • Where do I get answers?

If you seek answers from a money grabber, you’re in for a rude awakening. Maybe not immediately, but soon. Money grabbers are biased, they’ll give you answers with a bias to sell you something.

So, how can you tell a money grabber from a trusted source of good information? It starts with understanding who the players are in our industry.

The Players

There are four players (or roles) in our industry; manufacturers, vendors, partners, and practitioners. Each of the players serve a very important role in making our industry function, and one player cannot effectively exist without the others. Don’t fall into the trap of thinking that one player is any better than another, they’re all critical.

Let’s break them down.

Security Manufacturers

Security manufacturers provide innovative hardware and/or software designed to solve real-world information security problems. They are critical to the information security industry because they make the tools we all use to secure ourselves.

Security manufacturers have three responsibilities to our industry:

  1. Understand the problem they’re trying to solve enough to make an effective hardware and/or software solution.
  2. Make an effective hardware and/or software solution that solves a problem.
  3. Sell the hardware and/or software solution to people in order to make money.

The manufacturer obviously needs to make money in order to satisfy investors and stakeholders. They’ll also need the capital to make more products. Stop the cycle and the manufacturer dies.

All fine and dandy.

Problems arise when a manufacturer attempts to play other roles, like giving you non-product related advice. It only seems logical that the advice you’d receive would be biased by one of their primary motivations which is to sell you their products. A manufacturer wants to sell you things because they want your money. What they sell you might solve a problem, but if it doesn’t, that’s ultimately your problem. The worst practice is convincing you that you have a problem that in reality doesn’t exist.

Even if a manufacturer solves a problem for you, you need to ask yourself if it was the right problem to solve. Was the risk significant enough to warrant a reallocation of resources (personnel, time, money, etc.)?

A manufacturer is probably not the best place to ask your questions about where you should spend your next information security dollar. They’ll certainly have an answer, but it won’t be unbiased, and it may not be in your best interest.

Security Vendors

Security vendors are an interesting bunch. They don’t make products, they sell them. We need vendors though. We need them because they’re closer to our problems than most manufacturers, and they know products better than partners (up next). They give manufacturers a distribution and support channel, so the manufacturer can go back to what they do best, making things.

Vendors represent products made by the manufacturers, and probably provide support for the products too. Vendors are usually specialists in the products they represent and are the “go to” people for making sure your products operate the way their intended to operate.

Advice from a vendor might be closer to the truth, but it will still be significantly biased. Vendors get paid for selling products, and they only represent their suite of products. Vendors, like manufacturers, want to sell you something. Ultimately, they want your money. Solving problems will be limited to the products they carry and advice probably won’t take other creative possibilities into account. Security vendors usually don’t innovate much and are more likely to go with whatever the herd is doing.

Security vendors are the best place to go for advice about a specific suite of products, but are not the best place to go for unbiased expertise.

Security Partners

A true security partner is a consultant without bias, but someone without bias is a pipe dream.  The truth is, nobody is without bias, but good partners do their best to be a trusted advisor to clients with as little bias as possible. Good security partners who understand the importance of their role (in the industry and to their clients) are product agnostic. They strive to make recommendations based on what’s best for the client.

Partners also want your money, but they won’t make money if they betray your trust. Trust is what keeps them honest.

Advice from a security partner must be as unbiased and as objective as possible. Security partners are good at creating or finding innovative solutions to problems because they’re not tied to any specific product or suite of products. One problem with a security partner is they may not have the deep knowledge about any one particular product like a vendor or manufacturer may have. Partners try to compensate for this by establishing working (not selling) relationships with vendors and manufacturers.

Security partners are the best place to go for advice about solving your information security problems with as little bias as possible. A security partner would be the best place to start for answers to most information security questions.

Security Practitioners

The hard-working security people who bust their asses everyday to make their workplace and the world a better place. Security practitioners make (or influence) buying decisions and they’re the ones who live with the fruits (or consequences) of their decisions. Most security practitioners don’t have time to research everything and need others to assist them in fulfilling their own personal mission.

Security practitioners deserve, and should demand respect at all times.

OK, now you know the roles/players. Where’s the money grab?

Beware of People Who Do Everything

I’m speaking to the security practitioners now.

Wouldn’t it be great if you could go one place for everything? A one-stop shop. Seems like a great idea and a real benefit, but it’s ignorant to think that there wouldn’t be an undercurrent of bias that could hurt you and your organization.

  • A manufacturer is biased to sell you their products.
  • A vendor is biased to sell you something out of their suite of products.
  • A partner couldn’t even sell you products if they wanted to. A partner cannot be a one-stop shop even if they want to be.

If you’re comfortable with the bias and you’re comfortable with the inevitable waste of resources, you’ll be comfortable with the one-stop shop approach. It’s lazy and wasteful, but it’s your security program.

If you’re not comfortable with the bias and wasted resources, you might have a little more work cut out for you. The right thing is to use each player for what they were designed for. A manufacturer for buying their products, a vendor for buying from their suite of products and product support, and a partner for the best advice.

Problems come when a player doesn’t understand their own role. When a vendor tries to be a partner too or when a partner tries to be a vendor too. Worse yet is the player who tries to be manufacturer, vendor, and partner. If you didn’t know any better, the “we do everything” player has you by the neck.

In my experience, the most common offender of their role, almost like an identity problem, is a vendor. Many vendors grew their business through other means, maybe selling printers and copiers, maybe doing information technology (IT) work, or maybe reselling networking equipment. The vendor resells things, but as a matter of survival and as margins decrease, they look for new streams of revenue. One common stream of revenue is security consulting services where the market is relatively immature and where a vendor can realize more significant margins.

Two problems with the vendor who plays partner:

  1. The bias problem. I’ve already covered this, but it’s a significant problem. I’ve witnessed many occasions where a vendor has sold things to a client that were clearly biased by the fact that the vendor sells those products. It’s only natural that a vendor would sell products, but it’s the practitioner who pays the price.
  2. Good at some things, but an expert in no things. Nobody can be the best at everything, you can only be the best at one thing or maybe a few things. A vendor who sells copiers, installs Cisco networks, builds data centers, and recycles old equipment, is not likely to be an expert in information security. Information security requires a specialized skill set, and you will get what you pay for. Unfortunately, it’s the practitioner again who pays the price.

Vendors aren’t bad. Partners aren’t bad. Manufacturers aren’t bad. Things can get bad when one player tries to play multiple roles. These multi-role players do it because it’s in their best interest, not necessarily because it’s in your best interest.

Things can get bad for you when you play into a multi-role player’s hand. You wouldn’t know the difference unless you were paying attention. Spend every information security dollar like it’s precious, because it is. One wasted dollar is one less dollar to spend on other more productive and enjoyable things.

Before I close, and one last time, there is nothing wrong with manufacturers, vendors, or partners. They’re all critical. It just helps if you know who they are, and better yet, if they know who they are.