Stuart Lyle who works for a network operator in the UK has kindly written a guest blog for me today on the latest issue to hit Android. More details on Stuart can be found at the bottom of the post.
 |
| Stuart Lyle |
The “issue du jour” in the security industry today seems to
be the HTC security vulnerability – more info on the
BBC website or a more detailed view at
Android Police.
This is a very real, very valid vulnerability and HTC have
made what I would professionally describe as a cock up. Other vendors have
undoubtedly done worse and will do worse in the future. One can also have a
very long debate as to whether or not the guys at Android Police have acted
responsibly in publicly disclosing this so soon after private disclosure to
HTC. I‘m not going to get drawn into that debate – I’ll leave that one to
others who have more valid opinions.
My take on the whole issue is one of moderate indifference.
I read it yesterday, got a bit concerned by it and then I shrugged my shoulders
and uttered a noise I can only describe as “meh”. I can’t change the problem
and I can’t fix the problem so I have to view it pragmatically and sensibly and
consider the broad questions of what is the impact to me and what is the impact
of it on customers.
Impact to me? Well, I don’t use a HTC device so, harsh as it
may seem, I’m all right Jack! My data and my behaviour aren’t going to be
compromised, at least not through this vulnerability anyway.
Having done some reading and some checking, it would seem
that some of the handsets referenced in the disclosure aren’t on the open
market and those that are available have not been available for long. This is
also good. That means that there aren’t going to be millions of these devices
in use by customers. That starts to make me more comfortable in terms of
impact. It would also seem, through some conjecture by boffins who know this
sort of stuff, that it will be easy to fix. Again, more comfort. I’m almost
relaxed now. Almost.
Do you see what I’m doing here? It’s not rocket science -
I’m pragmatically trying to work out if this is really something I need to
invest a whole heap of my effort in. I’m asking myself how important this
really is to me, my life, my business and my customers. My response, given the
limited resources I work with, has to be commensurate to the risk that it
causes and the impact of that risk should it come to pass. I can rant about how
HTC have been a bit daft here all I like (and many on the Internet no doubt
will) but it’s not something I can directly influence or change easily.
Some of the thought processes I’m going through here are
described in a great book I read recently. I gave a copy of the book to all of
my security team (I’m not that generous, I’ve got a small team!). It’s called
“Shut
Up, Move On” by Paul McGee – or SUMO®. It describes a method and tools for
dealing with challenge or change and part of it is really about how we can
react to adverse solutions with a positive attitude. I’d encourage anyone to
buy and read the book and think about how those techniques are also relevant in
a security context. I’d particularly also encourage you to download the “7
Questions SUMO® cartoon” PDF from
Paul’s web site - and think about how those questions can be helpful when faced with a security
threat like this one. You might find it useful, you might not. I certainly do.
In any event and irrespective of how we, as a security
community, react to the incident what is really important now is how HTC
respond to this; both technically and publicly. I was somewhat disheartened to
see the quote from them on the BBC article – “HTC takes our customers' security
very seriously” – as it’s just a very old, very standard stock response line
and it doesn’t fill me with confidence. Crisis response and the effect that a
bit of bad PR can have on brand is, however, another job for another blog
another time.
About Stuart
Stuart Lyle CEng CITP MBCS AMBCI CISA CRISC
Stuart has been working in the mobile industry for 15 years
and has, throughout that time, worked in a variety of roles across fraud,
security, risk, continuity and compliance. Currently leading a small but
focussed security team at a UK mobile network provider, Stuart also holds the
position of industry vice chair at the Network Security Information Exchange
within CPNI and has also chaired a local collaboration forum for Business
Continuity across the Berkshire region. You can find out more about Stuart on
his
AboutMe page.
Stuart is a guest blogger on this site in a personal capacity – these views and
comments are all his and not those of his employer.
