I am feeling a bit "long in the tooth" today, because like many of our honorable colleagues here at the (ISC)² blog, I remember computer security before there was an (ISC)² and before there was a World-Wide-Web. Yes, there was security professionals before terms like "firewalls" became popular, believe-it-or-not.
Back in "the old days" we had to set up sniffers on both sides of a router to figure out how to set up access control lists. If we needed to change the passwords on all our network devices when someone left our "big telecom company" we launched a shell script, one that we wrote late at night drinking Mountain Dew, that logged into each network device and changed all the network device passwords.
In fact, network and computer security was just a matter-of-fact part of our days jobs, as was network and UNIX (and then Linux) system engineering. We found bugs and we squashed them as a routine part of our jobs. When we found vulnerabilities in global routing protocols like BGP, we contacted the vendor and they fixed the bugs, quietly. When we worked on some late night UNIX systems "glue" projects and found errors in how an OS managed shared memory, we simply let our vendor know. If we had access to the source code, we fixed it ourselves, and sent our patch to the vendor the next day via email.
So please forgive me when I tend to agree with Linus and his controversial statement, "one reason I[Linux Torvalds] refuse to bother with the whole security circus is that I think it glorifies - and thus encourages - the wrong behavior."
I actually flew to Amsterdam many years ago (just how many I can't recall at the moment) to attend the first Linux users conference and had the pleasure of buying a bottle of wine (and drinking it) with Linus. That was the first and last time our paths crossed. Linus is outspoken and does hold back any punches. In his security statement above Linus went on to say,
"In fact, all the boring normal bugs are way more important, just because there's a lot more of them. I don't think some spectacular security hole should be glorified or cared about as being any more "special" than a random spectacular crash due to bad locking."
Actually, that is exactly the way we viewed software bugs in "the good ole days" of UNIX/LInux system programming. We found bugs, then we squashed them. We drank a lot of Mountain Dew.
So, I am a bit puzzled by the escalating sensationalism and self-promotion that is the "new norm" for many of the so-called security professionals.
There is a looming danger of creating a hypersensational world of self-described security professionals out to make a name for themeselves by glorifying finding a bug, a hole or configuration error.
I will not names or recent news events, but I tend to agree with Linus that it is wrong to make heros out of "bug hunters" at the expense of the real code-slingers who write code every day, squashing bugs as a matter-of-fact. Let's hope they don't start calling a media event every the real code-slingers find one!
Walking down memory lane, I recall a large big gaping hole in BGP(4) many years ago and, when configured incorrectly, an attacker could hijack entire domains of Internet traffic by poisoning the global BGP routing tables. I was "on the job" advising a client when this hijacking happened, as the client witnessed a large chunk of their IP traffic redirected to a hostile country overseas. We just tracked down the error and we fixed it. We never sensationalized it. We did not call a press conference; nor did we try to make a big name for ourselves.
After all, configuring the network, fixing bugs, writing code, communicating with vendors, was just part of our day job!
How did we evolve to a world of "security sensationalism" where finding and fixing software bugs is somehow more glorified that writing good code, a good corporate security policy or a risk management plan? What about all the good people who have found countless bugs that have been routinely squashed and never sensationalized nor leaked to the media?
Part of Linus' statement was a bit harsh and I will not repeat it here. However, the idea behind what he said was correct. There are dangers in promoting a culture of bug hunter "hero worship" and a strong argument can be made that this type of sensationalism does encourages wrong, unethical, behavior.
