Twitter Security Pro: Encryption Isn't Enough - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud // Software as a Service
10:05 AM
Connect Directly

Twitter Security Pro: Encryption Isn't Enough

Companies need to focus on developing secure coding practices and security education.

Why Cloud Security Beats Your Data Center
Why Cloud Security Beats Your Data Center
(Click image for larger view and slideshow.)

Encryption can appear to be priceless when it's absent, as it was in the recent Office of Personnel Management breach. It can appear to be costly when it's present, as FBI director James Comey has argued. But not everything is as it appears.

Michael Coates, trust and information security officer at Twitter and global board member of the Open Web Application Security Project (OWASP), suggests encryption gets more credit than it deserves.

"Encryption is thrown around as the solution to prevent people from seeing your data," said Coates in an interview at InformationWeek's San Francisco office. "But if you dive into the dynamics of how data is stolen, you'll find that encryption actually is not effective in those scenarios."

Coates described a scenario involving a database with encrypted information. In order for a Web application to work with that database, it must decrypt the data.

"The way that data is most often compromised is through a vulnerability in the Web application ... So when the attacker steals the data, that data will be unencrypted."

Along these lines, a DHS official has asserted that encryption would not have helped in the OPM breach because the attacker had valid credentials. It may also turn out that encryption's ability to conceal crime from the authorities is overstated.

(Image: maxkabakov/iStockphoto)

(Image: maxkabakov/iStockphoto)

Coates stopped by in his OWASP capacity in order to promote the OWASP Application Security Conference, which takes place Sept. 22 through 25 in San Francisco. The aim of the conference is to raise the bar for application security by helping individuals and organizations understand how to build better defended software.

"There's a definite security talent shortage, so by educating more people we're hopefully bringing more people into the fold," said Coates.

Coates hopes the conference will provide companies with specific actions they can take to make their software more secure and with a roadmap to integrate best practices into their software development life cycle.

There are companies doing a good job with security, said Coates, citing Google, Facebook, Mozilla (where he used to work), Netflix, and Twitter (where he currently works). "The challenge is what do you say to the industry at large, to the companies in the Midwest that have one security person. ... They can't hire all these people and build custom solutions."

Coates agrees with Google and other computer security professionals about the need for access to intrusion software, something could become more difficult if proposed export controls are adopted. "I think security engineers need both [offensive and defensive] skillsets," he said. "Training someone how to attack software that they need to defend is vital. Anything less than that is just putting blinders on their eyes."

At the same time, Coates is focused on providing developers with the tools and knowledge to write secure code. "We can't just run around hacking ourselves secure," he said. "Instead, we have to say, 'I understand the symptom, how do I build a solution that is comprehensive and stops this problem from happening again in hundreds of applications?'"

Pointing to the way Java limits buffer overflow errors through array bounds checking and the way Python's Django framework uses templates to prevent cross-site scripting, Coates expects some help will come through advances in programming languages that limit unsafe coding practices.

[Read how a security failure can cost you your job. ]

But because each application is unique and there are still so many ways to introduce vulnerabilities, Coates is pushing for security training, and for security as part of the software life cycle. "You can't have security be this other team where you just throw things over the wall and fix stuff," he said. "That's a bottleneck and the business grinds to a halt. So you have to have this integrate into the life cycle and have tools that scale, because the cost of human capital for security is really high. And that's what I see in enterprises that are doing well. They've found a way to minimize the human involvement and instead use highly accurate automation."

Coates recommends that companies implement content security policies for their Web applications to defend against cross-site scripting. He also suggests using SSL everywhere and HSTS (HTTP Strict Transport Security) as defenses against man-in-the-middle attacks. He also advises use of the X-Frame-Options header, to prevent clickjacking (UI redress attacks).

"Fundamental security at the application layer and strong access controls at the enterprise layer governing who can interact with the data, those turn into the bread and butter of security," said Coates. "And that's where people need to spend the time."

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful ... View Full Bio

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ulf Mattsson
Ulf Mattsson,
User Rank: Strategist
7/24/2015 | 8:07:20 AM
Common issues across recent data breaches
I agree that "Encryption Isn't Enough." We are seeing a number of common issues across recent data breaches, stealing our most sensitive data, and I think it is time to re-think our security approach and be more data-centric. The large credit card breaches at Target, Home Depot, etc. - would not have amounted to anything if the data had been tokenized or encrypted. I think that we urgently need data neutralized to reduce its value to hackers.

Aberdeen Group reported in a very interesting study with the title "Tokenization Gets Traction" that tokenization users had 50% fewer security-related incidents than non-users and 47% of respondents are using tokenization for something other than cardholder data. Aberdeen also has seen a steady increase in enterprise use of tokenization as an alternative to encryption for protecting sensitive data.

Tokenization and improved authentication can be the game changers we urgently need in fighting data breaches. The payment industry is now adopting tokenization as a way to limit fraud.

Ulf Mattsson, CTO Protegrity
User Rank: Ninja
7/23/2015 | 2:34:44 PM
2 Great points here
Talking to many security folks at companies across North America this is exactly the same type of thing I am hearing.  Firstly, you nailed it with "The challenge is what do you say to the industry at large, to the companies in the Midwest that have one security person. ... They can't hire all these people and build custom solutions."

As much as we would love to simply say "get more layers of security in your environment", it's simply not a realistic message, since they often just don't have the resources to manage it.  We need to simplify.

Focusing on Web Applications, or applications in general, is a key security tactic that I think is often glanced over in favor of more traditional "We'll put in endpoint, and that should protect us".  Even as noted, encryption helps, but it's by no means a be-all-end-all form of security to protect data any longer.  We need to better understand application access and how data can be extracted through that application.  Putting a Web Application Firewall can absolutely help, but we also need to go back and look at internal applications and those external connects and better figure out how to make it easier to secure them, especially for smaller organizations who might be limited in security expertise.
Get Your Enterprise Ready for 5G
Mary E. Shacklett, Mary E. Shacklett,  1/14/2020
Modern App Dev: An Enterprise Guide
Cathleen Gagne, Managing Editor, InformationWeek,  1/5/2020
9 Ways to Improve IT and Operational Efficiencies in 2020
Cynthia Harvey, Freelance Journalist, InformationWeek,  1/2/2020
White Papers
Register for InformationWeek Newsletters
Current Issue
The Cloud Gets Ready for the 20's
This IT Trend Report explores how cloud computing is being shaped for the next phase in its maturation. It will help enterprise IT decision makers and business leaders understand some of the key trends reflected emerging cloud concepts and technologies, and in enterprise cloud usage patterns. Get it today!
Flash Poll