Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Right now I'm doing a work term through my school and they want me to write a report on something I've worked on. They are really serious about "proprietary reports" and reports requiring destruction after they've been marked. I'm planning to write about becoming PCI compliant and my boss tells me not to worry about marketing it as a "proprietary report". My question is, does making security details public increase or decrease security? I can't find the wikipedia article I read this on but after 9/11 a report found that agencies such as the FBI didn't share information enough, each agency felt that they worked to obtain the information and wanted to keep it confidential and to themselves which ultimately was counterproductive. Can it be seen as the same, the more people who look over a PCI implementation the more likely someone can spot a weakness?

share|improve this question

1 Answer 1

In general, the consensuses within the security community is that disclosing security practices (aka, transparency) leads to improved security. Transparency has many benefits:

  • It gives you motivation to do security right. Sometimes doing the right thing for security is annoying or costly, and having no one to account to makes it tempting to not do it the right way. When everyone can see what you're doing, you have more motivation to do things correctly.

  • It means that more people can scrutinize what you're doing wrong. An open system can be analyzed by many more people who can suggest improvements. In general it is assumed that motivated attackers will find these weaknesses anyway, so the more honest people that can see the weaknesses the more likely it is that the weaknesses will be reported in a timely manner. The alternative is living in bliss and only knowing about a problem once the attacker has exploited it.

  • It means that you are confident in your design. Security is hard to do well, and many people hide their security practices because their practices would appear bad. Making it open shows that you are not only comfortable with them, but that you are willing to fix problems that arise.

  • It allows others to learn from the things you do right or wrong. This has little direct benefit for you, but it allows others to benefit.

That said, transparency is really only beneficial if you plan to respond to security problems. If you aren't planning on it, transparency can cause problems because you make the attackers work less hard to find vulnerabilities.

PCI is a public standard that a lot of people conform to, so it's unlikely that very many of the details related to your implementation will be very unique. It's possible your boss doesn't think that information about proposed PCI compliance would be harmful.

share|improve this answer
4  
+1 - in heavily regulated sectors such as financial, security is no longer seen as a competitive advantage against peers, but something to be shared to protect the industry as a whole. –  Rory Alsop Aug 9 '12 at 22:29
    
And one reason for that is that a security compromise tends to harm the industry as a whole at least as much as it specifically harms the compromised company. (For example, the issues Dropbox has had with security have made companies much more hesitant to rely on cloud storage from any provider. The reliability problems Amazon had has made it harder for everyone too.) –  David Schwartz Aug 9 '12 at 23:49
1  
@RoryAlsop That's the idea, anyway ;) –  Polynomial Aug 10 '12 at 5:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.