The Human Side of Security

Mi2g's response to the SANS Top 20 list generated an entertaining discussion on the Dshield mailing list (http://www.dshield.org/mailman/listinfo/list). The discussion was winding down when a post by David Rice suggested an appendix be added to the Top 20 list to address Mi2g's concerns. For those of you unfamiliar with the Top 20 list, it is formatted like a Top 20 item.

Quoted in it's entirety (with Davids' permission)...

"I would recommend ammending the SANS Top 20 to include the following:

H1. Humans

H1.1 Description:
The species Homo sapiens supports a wide range of intellectual capabilities such as speech, emotion, rational thinking etc. Many of these components are enabled by default - though to differing degrees of success. These components are implemented by the cerebral cortex, and are under the control of the identity engine which runs as me.exe. Vulnerabilities in these
components are the most common avenues for exploitation.

The human brain is both locally and remotely exploitable through techniques such as unhealthy self-talk, low self-esteem, government propaganda, commercial marketing, sales representatives, phishing, social engineering, and magic tricks. For most of these vulnerabilities, exploit code is publicly available. Attacks exploiting these vulnerabilities have been seen
in the wild. An example of a large-scale attack involved exploiting a flaw in the brain's music handling routine where thousands of people purchased David Hasselhof's album "Looking for the Best."

Earlier versions especially Neanderthal and Homo Erectus do not enable rationality and intellect by default and are therefore considered "secure by default" (of course, extinction dramatically reduces a species' attackable surface area). Due to environmentally-derived improvements, Homo sapiens have a much broader mental capacity which increases the exploitable surface
area significantly.

H1.2 Systems Affected
All versions after Homo sapiens 1.3.27.5234a

H1.3 How to determine if you are at risk
- Ask yourself the question, "Who am I?" If answered, the system is at risk.

H1.4 How to Protect Against Vulnerabilities
- Unfortunately, patches to Homo sapiens have resulted in significant and harmful sequela such as holy wars, cola wars, communism, reality TV, and global warming; therefore, the current version of Homo sapiens is considered unstable and non-patchable. An upgrade/replacement from the open-source genomics community is eagerly awaited. In the mean time, consider the
following:
- Deny yourself admin rights.
- Determine if the vulnerability exists in a non-essential component that can be removed. Please take caution when determining this as it could break functionality if there are other services that depend on the component in question. If necessary, consult a physician.
- In some cases, exposure to the vulnerability could be removed by disabling the corresponding service. Please note: disabling me.exe will make the system unrecoverable. Make sure a backup disk is available. "

Thanks David for a great laugh!

Rick