ShortArm Solutions & The Cyber Pro Podcast’s Post

Transcript

What are some common misconceptions about cyber that you encounter way more than you should? Umm. My pet peeve is often companies, security companies that that do security through obscurity. It is just a fundamentally incorrect approach. So the idea is I've created a new cryptography algorithm. It's the best thing ever. It's really great, but I'm just not going to tell you how it works. So use it because nobody knows how it works and it's great. Stupidest thing ever. Run for the right if. If a vendor is telling you they've invented something new, asked what the algorithm is and ask them how many experts have actually studied it. The good stuff is open sourced, it's reviewed by academics for years, it's looked at from every possible angle. The security comes from knowledge and there's lots of examples in the past of mistakes that have been made. It's natural. Like I was involved. In the IETF working groups for the TLS protocol and there's an incident, not an incident, which is normal practice where I think it was TLS version 1.1 was published and people were using it. We've all looked at it. I mean, and people better than I am at the at understanding protocol like Yep, that's good ship it right? And one guy team and said, you know, I think that there's a man in the middle attack right there. And then everybody else looked at when like, ohh, you're right. There is there's a man in the middle attack, right? There were no, none of us noticed it. But because this is an open source process, we caught it early. That's why we now use TLS 1.2 in about to, you know, shifting to 1.3 because you can make those mistakes, but by having a large group look at it, you're more likely to catch the issues.