Sticks and stones: Picking on users AND security pros

Name-calling is harmful to the cause of security

I took my share of name-calling as a kid. I did my share of name-calling, too. We're taught that nothing good comes of such behavior. I've been thinking a lot about that since writing an article two weeks ago called " Security blunders 'dumber than dog snot'" during the 2010 USENIX Security Symposium.

The story is based on a talk of the same title given by Roger G. Johnston, a member of the Vulnerability Assessment Team at Argonne National Laboratory. In the presentation, he gave examples of surprising (or not) examples of what he has seen as a vulnerability assessor: security devices, systems and programs with little or no security -- or security thought -- built in. There are the well-designed security products foolishly configured by those who buy them, thus causing more vulnerability than before the devices were installed.

Then there are the badly-thought-out security rules and security programs laden in security theater, lacking muscle and teeth. In fact, some policies only make some employees disgruntled because they are treated like fools. In turn, the company risks turning them into malicious insiders.

Also see "Ouch! Security pros' worst mistakes

Johnston described three common problems: People forgetting to lock the door, people too stupid to be helped and -- worst of all -- intelligent people who don't exploit their abilities for the betterment of security. Enter what he calls the dog snot model of security-- where intelligence and common sense exist but are not used.

He came up with the term by watching his dogs, who often crash themselves against the picture window facing the yard when they want to go chase a squirrel. Hence, the windows are covered in dog snot. Executives and lower-level users are often like the dogs in that they bang their heads against the firewall (or their fingers against the keyboard) in an effort to get at a shiny object online. The security pros themselves can get caught up in this too, usually banging up against the glass by trying to prevent bad things from happening by repeating the same failed practices.

Moments after the story went live and appeared on Twitter, I got a message from Adam Shotack, co-author of "The New School of Information Security" and a security specialist at Microsoft.

"Is that attitude helpful? Does anyone respond better when you call them 'dumber than dog snot?'" he asked.

Shostack has never hesitated to tell me when he thinks my position is off target. When I wrote a column about getting grilled by the U.S. Secret Service for taking pictures at the White House, he suggested that I was too soft on the officers for their treatment of just another tourist with a BlackBerry camera.

I always welcome his feedback. He is, after all, one of the rock stars of the security industry. He didn't get there by tossing around hollow critiques and empty applause lines. When he talks, I listen. He's also one of the friendliest guys you'll ever meet.

So when he took me to task for comparing professionals' security mistakes to dog snot, I thought hard about it.

I've written before about how language is misused in the security industry and how it often does more harm than good. The last thing I want to do is contribute to the problem.

So let's look at the dog snot article and see where it fits in.

When Shostack suggests name-calling is harmful to the cause of security, I wholeheartedly agree. It's basic psychology. Put a person down often enough and their work will suffer. It's also against common decency to put down people who are working hard to do their jobs well.

But the folks at the heart of Johnston's talk weren't the same people. These were CEOs and other executives who have done foolish things online, putting their company network at risk, even though they should know better. These are the folks who create a workplace environment where people are always feeling embattled, raising the chances that some of them will use their hurt feelings to do some damage.

There were examples where blunders were the result of faulty installation of security devices, and that can be blamed on the security professionals who put them there. But Johnston didn't call them names. He didn't call the executives names, either. He focused more on the mistakes themselves and what other security professionals can learn from it.

As for the dog snot, he was talking about the actions of good people who often bang their heads against the wall by making the same mistakes over and over again. By flagging those blunders and calling them dog snot, he was trying to raise the awareness level, which is step one in this battle.

It's also important to note that he never once mentioned the mistake-makers by name or their companies. So hurt feelings shouldn't apply here.

I see individuals called out on Twitter by folks who don't agree with a point they made. Most of the time it's respectful disagreement that leads to a useful dialogue we can all learn from.

Sometimes, one security tweeter will use harsher language against someone they don't agree with. It's a lot rarer, but I've seen it happen.

Those instances are a lot like the behavior where users trash their bosses or co-workers online, usually via Twitter or Facebook.

The blunders Johnston talked about were caused by both the users/executives AND the security professionals. The former engaged in reckless activity and the security blunder resulted when the latter responded inadequately.

In the final analysis, it's wrong to call individuals names. It sinks morale and never leads to an improved performance. And to engage in name-calling online is something only a jerk would do.

But it should be OK to poke fun at the mistakes themselves. The people aren't dumber than dog snot, but sometimes the mistakes that lead to a blunder are dumb. Sometimes, it's OK to say that. We can even laugh about it, as long as we take the lesson to heart.

Language is difficult to master in any industry. In security, it's particularly difficult.

Read more about executive communication in CSOonline's Executive Communication section.

Join the CSO newsletter!

Error: Please check your email address.

Tags Penetration testingcybersecuritysecurity languagesecurity blundersvulnerability researchsecurityinsider threatsArgonne National LaboratorySecurity Leadershipvulnerability management

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Bill Brenner

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place