Just Culture and Information Security
[no description provided]Yesterday Twitter revealed they had accidentally stored plain-text passwords in some log files. There was no indication the data was accessed and users were warned to update their passwords. There was no known breach, but Twitter went public anyway, and was excoriated in the press and… on Twitter.
This is a problem for our profession and industry. We get locked into a cycle where any public disclosure of a breach or security mistake results in...
Well, you can imagine what it results in, or you can go read "The Security Profession Needs to Adopt Just Culture" by Rich Mogull. It's a very important article, and you should read it, and the links, and take the time to consider what it means. In that spirit, I want to reflect on something I said the other night. I was being intentionally provocative, and perhaps crossed the line away from being just. What I said was a password management company had one job, and if they expose your passwords, you should not use their password management software.
Someone else in the room, coming from a background where they have blameless post-mortems, challenged my use of the phrase 'you had one job,' and praised the company for coming forward. And I've been thinking about that, and my take is, the design where all the passwords are at a single site is substantially and predictably worse than a design where the passwords are distributed in local clients and local data storage. (There are tradeoffs. With a single site, you may be able to monitor for and respond to unusual access patterns rapidly, and you can upgrade all the software at once. There is an availability benefit. My assessment is that the single-store design is not worth it, because of the catastrophic failure modes.)
It was a fair criticism. I've previously said "we live in an 'outrage world' where it’s easier to point fingers and giggle in 140 characters and hurt people’s lives or careers than it is to make a positive contribution." Did I fall into that trap myself? Possibly.
In "Just Culture: A Foundation for Balanced Accountability and Patient Safety," which Rich links, there's a table in Figure 2, headed "Choose the column that best describes the caregiver's action." In reading that table, I believe that a password manager with central storage falls into the reckless category, although perhaps it's merely risky. In either case, the system leaders are supposed to share in accountability.
Could I have been more nuanced? Certainly. Would it have carried the same impact? No. Justified? I'd love to hear your thoughts!