Fire, Brimstone, and Bad Security Decisions

Fire, Brimstone, and Bad Security Decisions

Speaker: Wendy Nather

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch on YouTube

Reading time: ~9 minutes

TL;DR

Security's deepest problems are not individual mistakes but structural decisions made long ago that were probably correct at the time and have never been fully revisited. Wendy Nather, drawing on decades of experience as a blue teamer, analyst, and security leader, walked through how to recognize when a foundational decision has stopped working, why the industry keeps repeating them anyway, and how to begin changing course — with particular emphasis on building security that serves people on their worst days, not just their best ones.

Introduction

"Usually in security, when you are trying to figure out why something is the way it is, you start pulling on a thread and you end up discovering that it comes from a decision that somebody made long ago that was probably a good idea at the time." Wendy Nather opened her BSidesSF 2025 talk with this observation, and it sets the tone for everything that follows: a frank, experienced, occasionally sharp critique of the security industry turned inward, on itself.

Nather is not talking about incidents — a misconfigured S3 bucket, a missed patch, a phishing click. She is talking about decisions made in strategy, design, and policy that the industry keeps executing on continuously, long after the original assumptions have stopped holding. The password as the fundamental authentication credential. The antivirus as the architectural response to malware. Security awareness training as the primary defense against human error. These are not accidents. They are decisions — and understanding them as decisions is the first step toward changing them.

The talk fits squarely into BSidesSF 2025's "Here Be Dragons" theme: learning to smell the dragon before you walk into the cave.

The Original Sin: Separating Security from the Thing It Secures

▶ Watch: Security's original sin and recognizing wrong decisions (05:00)

Nather traced the industry's foundational wrong turn to the birth of antivirus software: the decision that when software can be exploited, the correct response is to fix it in a separate piece of software rather than in the original software. "Thus was born a, I think, twenty billion dollar industry around having security separate from the thing that it's trying to secure."

The cascading consequences of that architectural decision are, she argued, largely why the modern security industry exists in the shape it does — fragmented, additive, perpetually catching up.

She was careful to distinguish this kind of wrong decision from the scanning-and-scolding model of security critique — "oh, you missed a spot; here's a patch, good luck." The point is not to call out other people's bad decisions. It is to examine the industry's own, collectively and honestly.

How to Recognize a Wrong Decision

▶ Watch: Indicators of structural wrong decisions (10:00)

Nather offered a practical taxonomy of signals that a foundational decision has outlived its usefulness:

The environment has changed. The decision to store credentials in human memory made sense when there was one computer and one password. It stopped making sense long before the industry acknowledged it. "As you know, there are escalating consequences as a result of that original decision." The 90-day password rotation policy was based on the time it took to crack a password — a constraint that rainbow tables and large-scale breaches made irrelevant long ago, yet the policy persisted in audit standards for decades.

Trying the same thing repeatedly without success. Nather singled out security awareness training as the canonical example: how many decades has the industry spent training users not to click on things that are, functionally, their job to click on? "Why do we decide again that what security really is is deploying dynamic block lists into the poetry-generated custard of our employees?" The metaphor is vivid and pointed: human brains are not block lists, and treating them as such is itself a wrong decision.

Backlash from affected users. Nather recounted her time as a security leader for the state of Texas, where a 15-minute screen lock policy generated immediate and fierce pushback. A deputy's response — "work more, then it won't lock up" — produced exactly the kind of aftermath that signals a policy problem.

Avoidance and evasion. At the same organization, Nather discovered up to ten users sharing a single login account. The cause was an onerous, fax-based account provisioning process that users found so burdensome that shared credentials became the de facto workaround. "You can't really blame them — it was not an individual responsibility, it was a role they could hand over." When users build shadow infrastructure around a security control, the control is wrong.

Exceptions piling up. Nather's Law: "For every policy, there's an equal and opposite exception." When exception approvals start accumulating, they are evidence that the policy itself is no longer fit for purpose. "Every firewall rule is kind of an exception, isn't it? By the time you get to 'allow any any,' you're in trouble."

Technical debt. Short commit messages ("fix," "fix some," "fix more") are a signal that developers are moving too fast to document — which in turn signals that strategic decisions may be compounding into mounting technical debt that will eventually have to be addressed.

Bad Assumptions Behind Wrong Decisions

▶ Watch: Assumptions that produce wrong decisions (22:00)

Several of the industry's persistent wrong decisions trace to identifiable assumptions that were once valid and no longer are:

Security as a control function, not a service function. When computers were issued by employers and controlled centrally, treating security as enforcement made sense. Technology has been democratized; security must be too. Nather told the story of her teenager asking her to set up parental controls on her own phone — not so the parent could restrict her, but so she could enforce her own study boundaries. "It was serving her. It wasn't serving my interests." That inversion — security as something that serves the user's own goals — is the model the industry needs to move toward.

Assuming universal understanding. Early tech culture had a homogeneous background; "intuitively obvious" was a reasonable phrase. Today, every user has a different mental model of how technology works and is affected by security controls in different ways. A zero-trust policy that requires multi-factor authentication on a specific device fails entirely for users who are unhoused, share a family phone, or rely on library computers. SMS-based MFA fails at night in parts of India where carriers disable SMS to limit spam.

AI systems making assertions without fact-checking. Nather noted that ChatGPT's AI-generated bio of her claims she worked for the NSA — she has never worked for the NSA. She demonstrated a more striking example: uploading a photo of herself wearing a borrowed DARPA cap to an AI model, which then generated detailed inferences about her salary range, political leanings, religious beliefs, and workplace — all confabulated from a single hat. "Think about how that affects everything that we decide in security — how many of those strategies go to an assumption that was well-intentioned but just didn't work out?"

Security Must Work on Your Worst Day

▶ Watch: Building security for bad days (32:00)

The most affecting section of the talk drew on Nather's personal experience. Her husband Marcos passed away in 2023, two weeks after a brain cancer diagnosis. He had managed their home infrastructure for thirty years — ten laptops, a cluster of twelve Raspberry Pis, a self-hosted email server — and left behind only a master password on a scrap of paper in an undisclosed location.

"I should have been able to get in and find his password manager," she said. "I just could not." A friend — HD Moore — came over, cracked the passwords, mapped the network, reset credentials, set up a VPN. And Nather still couldn't complete the transition: "There was something in my mind that just blocked me. A year went by and I would come back to this house and look at this every month and I still could not touch it, because it was the last part of him."

The point was not technical. It was about what happens when the human operating your security design is not functioning at full capacity. The military knows this. Instructions like "front toward enemy" are not written because soldiers are unintelligent; they are written because in combat — when you are injured, cold, grieving, terrified — you need information to be as plain as possible. A mine's back panel explaining not just "do not burn this" but also why (the smoke is toxic, referencing a practice from Vietnam) is a model for security design: explain the reason, because not everyone will understand it the way practitioners do.

"Security needs to be usable on your worst day," Nather said, "not just your best day." The audience this applies to includes people experiencing mental health crises, cognitive decline, grief, homelessness, or any of the countless circumstances that reduce a person's capacity to execute the security workflows practitioners design for healthy, attentive, technically sophisticated users.

Changing Direction

▶ Watch: How to change course on wrong decisions (38:00)

Nather acknowledged the structural difficulty of course-correction: sunk cost fallacy, ego, fear of external judgment, and the cognitive grooves worn by years of working the same way. She offered practical mechanisms:

• Tie remediation to business initiatives. If a company is entering a new market or undergoing an acquisition, that transition creates a natural moment to revisit foundational assumptions along with it.
• Slice the work into short-term projects. Rather than attempting a wholesale overhaul, embed incremental correction into every ongoing project.
• Maintain a technical debt register alongside a risk register. These often overlap, but naming them separately keeps both visible and manageable.
• Be honest that maybe the current generation of leaders is not best positioned to lead the change. The assumptions embedded in thirty-year veterans' thinking are part of the problem. Bringing in perspectives from people who do not share those initial assumptions — including the next generation of practitioners — is not an admission of failure. It is good engineering.

The talk closed on a note that was simultaneously pragmatic and humble: you cannot predict wrong decisions before you make them. The best available strategy is to build in the habit of asking, regularly and honestly, whether the assumptions behind a decision are still true — and to create organizational cultures where the answer "no, they're not" is safe to say.

Notable Quotes

"Usually in security, when you are trying to figure out why something is the way it is, you start pulling on a thread and you end up discovering that it comes from a decision that somebody made long ago that was probably a good idea at the time — but just now it's not good anymore." — Wendy Nather (02:00)

"For every policy, there's an equal and opposite exception. That's Nather's Law." — Wendy Nather (18:30)

"Security needs to be usable on your worst day, not just your best day." — Wendy Nather (35:00)

Key Takeaways

• The security industry's deepest problems trace to structural decisions, not individual mistakes. Password-centric authentication, security-as-separate-software, awareness training as the primary human defense — these are decisions, and they can be revisited.
• Recognize wrong decisions early through their signals: repeated failure, user avoidance and evasion, accumulating exceptions, mounting technical debt, and backlash from affected populations.
• Bad assumptions drive wrong decisions — in particular: that security is a control function rather than a service, that all users share the same mental model, and that AI-generated information can be trusted without verification.
• Security controls must be designed for users on their worst day. Grief, illness, cognitive decline, poverty, and crisis are not edge cases — they are part of the human condition that security design must account for.
• Course correction requires courage and structural support. Tie remediation to business transitions, slice it into short-term work, maintain a technical debt register, and actively include perspectives from people not burdened by the original assumptions.