Schneier on Security

Hey, wanted to reply and drop you a note. I'm a co-founder at Aptible, and we spend a lot of time thinking about how to help developers in your situation.

In terms of general reading, I'd suggest:

--------------

Blogs:

Bruce Schneier [0]

Brian Krebs [1]

--------------

Whitepapers:

- Google's BeyondCorp paper touches on issues that most cloud-first companies will find familiar [2]

- AWS has a few that are good for seeing how a large company communicates the scope of it's security program to customers and potential customers. [3] I'd start with "Introduction to AWS Security Processes" aka "Overview of Security Processes" and "AWS Risk and Compliance".

- Verizon's Data Breach Investigations Reports [4]

--------------

Standards:

- Request your IaaS provider's SOC 2 Type II report

- ISO 27001 is worth buying

- The Cloud Security Alliance's CCM tries to cross-map different frameworks, and is a good reference for a high-level rundown of various security management controls and activities [5]

--------------

In terms of books, conferences, and meetups, I'm sure there is good stuff out there that I'm not aware of because of limitations on my time, sorry.

I hope this is helpful. Good luck! You (or anyone reading) can reach out to me at the email in my profile to chat about any of this.

p.s. Shameless plug: We are launching a product for managing infosec + compliance programs at companies like yours.

--------------

[0] https://www.schneier.com/

[1]…

Or make everyone go through metal detectors and millimeter wave scanners at the airport, take their shoes off, treat any liquid over whatever the small limit is like it’s bomb-making material (but still let that person fly; checkmate, would-be bomber!)…it’s all security theater. Notice how they don’t release their testing rates on how many of the test weapons and threats make it through TSA security, because then it would be too easy to point to that and rightfully assert that they utterly fail at their mission while wasting untold lifetimes worth of human time and make travel that much more miserable. https://www.schneier.com/blog/archives/2015/06/reassessing_air.html (2015) is a good read on that if you don’t already know.

My point is that when politicians do something “to save the children”, it’s rarely about actually helping anyone but themselves.

p 11 (/30), makes a terrible case in handwaving.

It ignores the requirement that secret data needs to stay secret for 30 years, or 100 years, or long into the future, and attacks only get better.

https://www.schneier.com/blog/archives/2009/07/another_new_aes.html

> They also describe an attack against 11-round AES-256 that requires 2^70 time—almost practical.

>> AES is the best known and most widely used block cipher. Its three versions (AES-128, AES-192, and AES-256) differ in their key sizes (128 bits, 192 bits and 256 bits) and in their number of rounds (10, 12, and 14, respectively).

>> In the case of AES-128, there is no known attack which is faster than the 2^128 complexity of exhaustive search. However, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2^176 and 2^119 time, respectively.

You might be interested in Bruce Schneier's take on trust and what prevents predatory behaviour. In his book Liars and Outliers he gives a taxonomy of 4 elements: law, reputation, morality, and security.

Reputation and law are similar in that they're imposed by a community, but differ in that law follows a formally codified code, and of course the consequences imposed tend to differ. Morality is the internal motivation not to wrong others. Security describes physical/electronic measures that cause the predatory behaviour not to be practical in the first place, or at least raise the bar.

Schneier's own summary: https://www.schneier.com/blog/archives/2012/03/liars_and_outli_5.html

A review, hosted on Schneier's site: https://www.schneier.com/news/archives/2012/12/liars-and-outliers-by-bruce-schneier-review.html

You need to think more about your model of trust. You will quickly discover that all security is built on trusting someone, even in the examples you mention above. You can compile your own kernel, but you trust kernel developers to not have put exploits in the source code. You can't audit the source code itself. You also trust your compiler to accurately compile the source code. You also trust compiler developers to not have put exploits into the compiler itself. You also trust the compiler they used to bootstrap their toolchain to compile the compiler.

Fundamentally, all security is based on trusting somebody, understanding their incentives and intentions and weighing risk and reward. An excellent book on the subject is Bruce Schneier's "Liars and Outliers" https://www.schneier.com/books/liars-and-outliers/.

https://en.wikipedia.org/wiki/High-trust_and_low-trust_societies

Trust is a technology, the transition to a high-trust society unlocks so much potential that was previously used on "basic" tasks like guarding your property, making sure your food is fit to eat, not getting scammed in a trade etc.

Bruce Schneier has written a book about trust https://www.schneier.com/books/liars-and-outliers/ ; I don't want to oversell it, I didn't find it amazing, but it has some very relevant discussion on how trust has evolved into our society and institutions. Ultimately a society where people can't trust each other and communicate efficiently will be outcompeted by a society where people can, either through individual altruism, societal norms or institutional enforcement.