Stop Saying Cybersecurity When You Mean Infosec (and vice-versa)
How to choose a sub-$100 Android Tablet – and not be disappointed

Must Read for Infosec Pros: Rich Mogull on Apple Security Strategy

You may have missed this jewel of an infosec post by Rich Mogull amid the hashtag avalanche of NSA, PRISM, or FISA articles last week. Rich's post, Apple Security Strategy: Make It Inivisible, impressed me as shedding light on singularly important design objectives that all information security efforts ought to consider. The post is both a really insightful article about Apple's security design and philosophy, and a learning opportunity for security designers or practitioners generally. 

Among the many insights Rich shares, these three messages in particular could form the basis for secure implementation or deployment:

  1. "Good user experience doesn't have to come at the expense of leaving users vulnerable to security risks."

    Challenge the widely asserted notion that "you can have security or usability but not both" (Yes, there are variants that add other characteristics such as performance). A recent Washington Post article asks why NSA-proof encryption is available but not widely used. The list of reasons are sadly similar to the list one might have composed in the 1990s. One of the principle inhibitors is the fear of losing the password that users create to protect private keys. Rich notes that Apple's FileVault 2 achieves both security (encryption) and usability (recoverability).
  2. "The more you impede a user’s ability to do something, the more likely that user is to circumvent security measures, so avoid this as you design."

    There may be no more obvious assertion in infosec than this, but I can't think of a single operating system I use that doesn't fail in some respect to consider this design essential. 

    However, I'd broaden this beyond circumventing a security measure to include having to temporarily override the measure when the user has more (trust) information than the device or OS. If I inventory all my device's OSs, I can quickly recall examples where I'm forced leave an application to alter a security setting  to deal with an exception condition (Android's "unknown source", for example) and then must remember to return to the more secure setting once I've dealt with the exceptional circumstance. Micro-managing Java in the Browser as Rich describes in this article is a good example of how to mitigate this threat.
  3. "Tackle a real-world security issue by trying to make that issue simply go away for the average user."

    Leveraging cloud services to help the average user manage security features across a myriad of devices (including her own) as Apple has done with iCloud Keychain is promising and infosec ought to think more in this direction.

Read Rich's article for the full effect. 

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

Verify your Comment

Previewing your Comment

This is only a preview. Your comment has not yet been posted.

Working...
Your comment could not be posted. Error type:
Your comment has been saved. Comments are moderated and will not appear until approved by the author. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Working...

Post a comment

Comments are moderated, and will not appear until the author has approved them.

Your Information

(Name is required. Email address will not be displayed with the comment.)