At Tracebit, our goal is to bring canaries from the 1% to the 100% of security teams by making them a ‘no brainer’, easy and safe to deploy whilst producing a low volume of valuable, actionable security alerts.
In this article, I’d like to answer a question we hear fairly often which also gets at the core of why we founded Tracebit in the first place:
Canaries are a great idea, but why not just build them myself?
There’s a general 'build vs buy’ topic here, but there’s already some great writing on this subject - Rami McCarthy's discussions on challenges in security engineering and the Hammer and Nail trap are a great starting point. Moving beyond security we liked Teleport’s Build vs. Buy for Startups article and Amazon’s Buy vs. Build Revisited: 3 Traps to Avoid.
We founded Tracebit because we think canaries are incredibly valuable but generally represent undifferentiated work for a security team.
When it comes to canaries, we believe that teams often over index on their ability to deploy canary resources themselves, fail to tie the security canary program to concrete goals and underestimate all of the work required to build a robust, enduring security canary program.
Why there’s a bias to build canaries
Beyond 'build vs buy' there can be a bias to build canaries specifically, we've identified three sources for this bias.
In house skills
The best canaries - whether it’s a cloud bucket, API token, server, or anything else - look and feel exactly like the real thing.
A key source of this build bias is the fact that for any resource an organisation may wish to ‘canary’, they will already have people, process and technology for deploying these types of resource.
For example, if an organization has 500 S3 buckets, these two statements likely hold true:
- It makes sense for that organisation to create canary S3 buckets.
- The organisation is good at deploying S3 buckets.
So, organisations are usually already quite good at deploying the types of resources which it would be valuable for them to canary.
Specialist knowledge
The other factor is that there’s an assumption that the security team has their own unique knowledge about the systems and business that will make them perfectly placed to create more realistic canaries, be it naming schemes or sensitive project names.
Potential for canaries
Finally, there exists a pre-conception that there’s a ceiling on the number and types of valuable canaries available (e.g. it's just S3 Buckets or Credentials), as opposed to this being a valuable strategy across the organization that can apply to many different systems and applications.
Taking a step back with canaries: What do you want from canaries?
Before jumping to how to build, we’d suggest that the first thing you consider is what success actually looks like for you in your security canary program.
This might sound obvious - but we’ve met many teams where the first step they took was “scatter canary credentials around” without aligning on the end goal, sometimes missing an opportunity to improve their security program at all.
We’d argue that this is why some canary programs fail to takeoff - they fizzle out because they aren't tied to any concrete security objectives or goals.
We’d suggest that you consider:
- The security outcomes you would like to achieve with the canary security program
- Where this would place you in terms of maturity in the different categories on the Security Canary Maturity Model
To save the click (though we’d recommend it), the security canary maturity model breaks down 3 levels of maturity:
- Defined - Initial steps in to canaries taken
- Managed - Maintainable program is in place
- Optimized - Advanced program is in place
Security Outcomes and Canaries
To make this concrete, let’s take 3 example use cases that could be part of a team’s wider goals and consider their maturity level in the security canary maturity model (you can read a longer list here).
By thinking through the particular outcomes you wish to achieve and applying the security canary maturity model, you can quickly identify the level of maturity you likely wish to attain.
Our view is that when considering the desired outcomes it will generally become clear that implementing a security canary program of at least the Managed level is necessary. This is where real value of a canary program begins to be realised. There is, however, a non-trivial amount of work involved to attain this level.
The work to be done
So if we take this back to the start of the article - we’re still deploying canaries, these are still resources that an organisation will have the skills to deploy themselves, is this really going to take that much work?
The Security Canary Maturity Model does a great job of breaking down the various features you may or may not wish to build, many of which are actually quite tangential to just deploying those resource types or customising them to match your environment.
To help in your decision making, we wanted to draw on some themes from this model and consider the amount of work involved to implement them, and add some details and gotchas you may hit along the way.
Hopefully this shows quite concretely that actually to get the results you want from a security canary program, there’s a lot of work to do.
If we consider the biases we highlighted earlier - having the skills to deploy these resource types and the knowledge of the environment, does not give a significant advantage to deploy canaries yourself.
Considerations if you DIY
So to recap, when thinking about your canary program:
- Align on the security outcomes you are seeking to achieve
- Leverage the Security Canary Maturity Model to understand the implications this has for the feature set you will need to implement
- If you still wish to build in-house, be realistic about how much work is going to be involved to do this yourself, both the initial set up and on-going maintenance, and trade this off against other security work that could be done instead
Naturally, we have a strong bias here, or Tracebit would not exist today, but we’ll leave you with a few of the original ideas that got us excited when building a security canary platform.
- It’s crucial you trust that the canaries you deploy will alert you when you need - someone thinking about this 24/7/365 is really the best way to have this trust.
- The true value of canaries unlocks when they are dynamic and automated, keeping both attackers and insiders guessing. This becomes 10x more powerful when new canary types and approaches are being shipped constantly.
- 99% of the work of a canary deployment is undifferentiated to the specific business. The security team has more differentiated work they could be investing their time in that is truly unique to your particular business.
If you’d like to learn more about how we’re helping teams implement security canary programs, please Book A Demo!
