Galois won an NSTIC pilot!

NIST just announced that Galois received a grant from the National Strategy for Trusted Identities in Cyberspace! I'm very excited to be leading this project here at Galois and the related work at Tozny.

Galois, Inc. (Portland, Ore.: $ 1,856,778) Galois will build a tool to allow users to store and share personal information online. The user-centric personal data storage system relies on biometric-based authentication and will be built securely from the ground up. As part of the pilot, Galois will work with partners to develop just-in-time transit ticketing on smart phones and to integrate the secure system into an internet of things-enabled smart home.

Article: Don't fall into the MVP trap!

Isaac's article on building security into the software development lifecycle was published in August at Software Magazine. My key point is that the market demands of software development encourage leaving security to the end for a variety of reasons:

• Many companies want to validate a market before investing in product security, so the “minimum viable product” (MVP) approach might leave it out.
• The risk of getting attacked is lower at the beginning of a product’s lifecycle, so companies can validate a product by getting market traction even if it has vulnerabilities.
• Ultimately, it comes down to a false assumption that your “minimum viable product” will not attract serious attackers, but this presumes that you do not get traction or media attention, which is a lose-lose proposition—either your MVP is a failure, and so security doesn’t matter, or your MVP is a success and you will get attacked.

KATU News: Baby Monitor hacks

Isaac was interviewed via Skype by KATU news to comment on about Rapid7's case study on security vulnerabilities for baby monitors. Key points to keep in mind:

• Internet of Things devices are being connected to the Internet without sufficient analysis of potential security problems.
• The security industry doesn't have enough personnel to help address these issues.
• Companies don't take security seriously during product development.