Does cynicism have a valid role in information security? [closed]

Question

The other day, I participated in a discussion on Meta Stack Overflow about what to do when a user publishes credentials (usually inadvertently) to a Stack Exchange post. (GitHub and other sites have similar problems.)

I realized after posting my thoughts that it seems quite cynical for me to always assume that the credentials have been compromised, even if they were only visible to the whole Internet for just a few minutes/hours. And at least one other person pointed this out.

Cynicism is not usually intuitive for me. At work and in life generally, I find that it's better to give others the benefit of the doubt and treat them like real people rather than, say, criminals or malicious users.

So my question isn't about whether I'm right or wrong or even what to do. But I am wondering, does cynicism play a valid role in information security? And to clarify, I'm not talking about being a cynic who is miserable to be around because the negative attitude rubs off. I mean is it recommended from a security perspective to assume that others are motivated only by self-interest? (Or, in other words, is it acceptable to assume that if somebody could have stolen your credentials, they did steal them?)

Is it even possible to approach security from the perspective that people are basically virtuous? (As in, would it solicit a more positive response from potential threats and thus minimize risk?)

If you have specific historical examples or some sort of related academic/scientific publications, that would be helpful.

Answer 1

Information security is all about risk management, it's not about being positive or negative, but about being factual. In risk management we take the likelihood, assess the exposure of attack (vulnerability) and then there is an actor with a certain motivation or any circumstance or event with the potential to adversely impact an asset.

Now if we take your situation: A user publishes credentials on StackExchange or Github.

The threat actor here are people having unauthorized access to the credentials. The vulnerability here is the exposure of the information. The likelihood has to be assessed, in order of likelihood:

• High traffic website, lots of people will have seen it
• High traffic website, Google indexes quite fast and caches
• Caching websites like the Internet archive
• Credential harvesters

But we can state that the likelihood is highly likely that they have been exposed. So we have loss of information.

BUT what is the likelihood that these credentials will be abused? That will depend on the situation, but we can't assess that as we don't know what the credentials are all used for. It could be that they are used for production systems, but even for a developer's personal account. Let's say it's low because it's an internally used system.

So then we assess what the cost would be if the system would be compromised. It could either be direct financial loss or indirect financial loss due to reputational damages or the inability for people to work. But it could also be that the password is only used in development and that the exposure would only be limited to a single developer's machine.

Let's say that the chance of the system actually being compromised is low, but the impact is high. Then we have an overal risk of medium as low x high = medium. As we can't valuate the actual cost of the risk in this example I'm not going to put a number on it, but normally you would be able to valuate the risk.

Now finally, what is the cost to reduce or mitigate this risk? How much time does it take to change this password? Let's say it's not a lot. We can say that the cost is quite low. Is risk mitigation cheaper than when the risk would occur? Yes, so let's mitigate it.

What I wanted to point out is that it's not about cynisism, it's about covering risk and cost. Being positive or negative has nothing to do with it, it's about measuring as objectively as possible what the exposure is and what the potential cost is.

The fact remains is that you can PROOF the credentials have been exposed, but you CAN'T proof that no-one harvested them. And that's pure factual.