Top Tweets for #securityisntsecure
@stefihane @robvank ... I've long been concerned that the intellectual basis for conventional cybersecurity is busted and needs an overhaul. Critically, the word "secure" in cyber is not what regular people think or expect. See https://t.co/VJxumBAs2I
And I tagged a few examples #securityisntsecure.
"Security" cameras? Ha! Can someone sue the manufacturers and installers for false & deceptive product labeling? #securityisntsecure
https://t.co/PSgkuO0REx
This prompts my Periodic Reminder that #securityisntsecure. “Security” Pros who sincerely advise clients that breaches are inevitable need to find a different word for what they do, coz it can’t be “securing”.
The three most important things experts understand about software security:
1. Software is unbelievably unreliable and insecure.
2. No, really, you have no idea.
3. It’s actually even worse than that.
@stevetout “Wake up call?”
FFS it’s a revive-the-stone-cold-dead. How do people build systems with so little forethought?
I seriously think their risk assessment begins and ends with “Meh. It’s not going to happen to me!”
#securityisntsecure
“We’ve made everything worse in the past 25 years” by connecting everything so everything can be hacked - @dgwbirch #KNOW2019
Yup. #securityisntsecure
@iang_fc @ZacharyJeans @S_dF @mdkail @AndrewNebus QSAs have admitted to me, straight faced, there is no way they can say a company is still compliant the day after an audit. I say they shouldn't use the word "secure". People deserve some lasting confidence in the security of an audited organisation. #securityisntsecure #PCIDSS
@iang_fc @ZacharyJeans @S_dF @mdkail @AndrewNebus More detail on my #infosec critique: https://t.co/YsUw6PKPHV
"Security is a long dark night, punctuated periodically by auditors".
#securityisntsecure #AusCERT2014 #AusCERT #ISMS #ISO27000
@iang_fc @ZacharyJeans @S_dF @mdkail @AndrewNebus “Intellectually” is the qualifier to make my terse hashtag more precise #securityisntsecure.
People might think I meant job security.
@ZacharyJeans @S_dF @mdkail @AndrewNebus I say #infosec is no longer intellectually secure. The explosion in root causes has outstripped security orthodoxy. IMO main causes include
- haste
- complexity
- poor SW quality
- slapdash #SDLC
- #MVP mindset
- toxic #Agility
- connectivity fetish.
#securityisntsecure
@mattblaze It’s a good point that data custodians seem to lose interest or motivation over time (which is why old Personal Data should be deleted when no longer needed).
But I’m also reminded that security doesn’t degrade smoothly. It’s highly nonlinear. #securityisntsecure
@strandjs Indeed. Security isn’t a game. The practice needs a root-and-branch overhaul. https://t.co/yrHbC0VRV9 #securityisntsecure
Agreed. Security like safety needs the less flashy stuff. Simpler system designs. Simpler code. Careful painstaking code design. Design reviews. Testing. Training. Legal sanctions for deficient product.
#securityisntsecure
Who else thinks a “cybersecurity moonshot” is a horrible way to think about security? Getting safely to the moon and back, before 1970, was a discrete goal, against the laws of physics and nature. “Cybersecurity” is a never-ending process vs an intelligent, adaptive adversary.
Terrific security panel at #CCE2018.
MyPOV: Time to move past the geeky romance of colored-hat hacking, and the dominant combative military metaphors. #Cybersecurity comes with simpler systems, slower more careful coding, and testing testing testing. #securityisntsecure
Why do people say “Security by Design”? Why isn’t security - without qualification - understood to be *designed*?
OK, there’s no need to answer. I’m the first to complain that #securityisntsecure. The profession needs an overhaul. But appending “by design” is faddish. #PbD
@1WorldIdentity MyPOV: No #cybersecurity in practice today is fit-for-purpose when it comes to genetic data. Or medical records for that matter. The very same companies and analysts in charge of these systems will tell you that "breaches are inevitable". #securityisntsecure
MyPOV: Some projects are just too big to secure using today’s cybersecurity methods. #securityisntsecure https://t.co/gT9Q49Qa97 via @thewire_in
@andredurand But not without grave risk! #WannaCry
I don't want to see #IoT appliances in air traffic control towers or power plants.
Or hospitals.
Or anywhere really. #Securityisntsecure #Identiverse
Brad Smith, President Microsoft, urges us to “open the eyes of the world to the impact of cyber attacks”. #RSAC
MyPOV: okay but we infosec pros need to open our own eyes. It’s not outsiders that ship product with bugs like #gotofail and #heartbleed. #securityisntsecure
@ASPI_ICPC @Mich11775 Can I suggest that #IoT security is tragically beyond the capacity of today's cyber methods? #Infosec is in need of a radical overhaul. QA, #SDLC, #MVP philosophy, #agile are all weak. #SecurityIsntSecure https://t.co/VJxumBiiOA #ICPIoT
@iang_fc @wendynather @lsaiz Of course we know. But dev and implementation are so Balkanized we get overwhelmed. Insecurity is the norm.
- horrendous complexity
- little testing
- little inspection
- systemic corner cutting (#Agile, MVP)
- spaghetti code.
#securityisntsecure
Most Popular Users
Elon Musk 
@elonmusk
241M followers
Barack Obama
@barackobama
119.2M followers
Cristiano Ronaldo
@cristiano
111.9M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.2M followers
KATY PERRY
@katyperry
88.4M followers
Taylor Swift
@taylorswift13
82.2M followers
Lady Gaga
@ladygaga
73.8M followers
Virat Kohli
@imvkohli
71M followers
Kim Kardashian
@kimkardashian
70.1M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.3M followers
Neymar Jr
@neymarjr
63.9M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.4M followers
X
@x
60.8M followers