At Yahoo, being paranoid comes with the job

At Yaho<= st1:PersonName w:st=3D"on">o, being paranoid comes with the job

By Joris Evers
Staff writer, CNET News.com
June 26, 2007, 4:00 AM PDT

Editors'= note: This is part two of a four-day series examining the state and future of Web security<= /span>.

To Artur= o Bejar, the name = of Yahoo's security team made perfect sense when he c= ame up with it eight years ago: the "Paranoids."<= /b>

Bejar, wh<= st1:PersonName w:st=3D"on">ose own title is "Chief Paranoid = Yahoo," wanted his department's monike= r to be disarming and give the security role a friendly face.

"We try to be somewhat lighthearted about security,&q= uot; he said. "As important as= it is, I also think it helps adoption if it is not too serious."

The unconventional naming befits a company that w= as once an icon of dot-com counterculture, where its co-founders still carry the title of "Chief Yahoo". That informality--or at least the perception of it--is particularly important to Yahoo, whose goal is to be the most consumer-friendly of all the companies at the forefront of creating security standards= in the Digital Age.

Yahoo has long viewed itself as a media company, unlike the hard-core technological ro= ots of rivals Google (search engine) and Microsoft (operating systems). But make no mistake: despite its casual nomenclatur= e, the company is dead serious about the issue of security. In this regard, the term "Paranoi= ds" can be taken most literally.

There are Paranoids throughout Yahoo, of both the uppercase and lowercase va= riety. The company, the third biggest Web firm= , won't share numbers but sugges= ts that there are more than the 5= 0 or so dedicated security staffers reported by rivals Google and Microsoft. Moreover, aside from the core team run by Bejar, various departments have ambas= sadors, known as "Local Paranoids," who may not be part of the full-time security team but serve relat= ed duties.

Yahoo employees get basic training during orientation and people in product management r= oles can follow a security quick-start course.= More in-depth security training is provided by Yahoo's Paranoid University, which tours around the world.
For the past three years, Yahoo has also held a "Security Week." It is the biggest interdisciplinary conference at Yaho<= /st1:PersonName>o that includes speakers from within and outside the company. External speakers have included securi= ty luminaries Matt Blaze= and Dan Geer. Nowhere else are= employees likely to get annual reviews on their "paranoid effectiveness.&= quot;

The paranoia is justified. Yahoo has faced a broad array of Web security tr= oubles, ranging from bugs in its instant messenger software to cross-site scripting flaws tha= t could leave accounts vulnerable to forgery and hijacking or unwittingly help launch data-thieving phishing = scams.

Bejar hims= elf is the personification of the two sides of Yahoo's security perspective: although= he is fully committed to the safety of his company's far-flung operations, he shuns the stereotypically f= oreboding image of a Web security professional.

"A lot of people have preconceptions about talking to the security guy," he said. "When = you're talking to a Paranoid, it has a different feel."

Becoming= a superhero
One difference between Yahoo's security stars and law enforcement is the uniform. Do well in security at Yahoo and the company will give you a T-shirt that's= blue, green or red, depending on the effort. Blue is for good, proactive efforts, green for heroic efforts and red for people who have gone beyond the call of duty for a long time.=

The shirts are awards that aren't given out to just anyone. They have become conversation starters on the Yahoo campus. "We have never given one as just a favor, or in barter, to friends or family, not one. Everyone with a 'Paranoids' T-shirt has earned it," Bejar said.

Employees who do something really exceptional for the security o<= /st1:PersonName>f Yahoo users are turned into a superh= ero, a "Super Paranoid." A cartoon artist renders the individual as a superhero, which gets publicized inside the company. This prize also includes a bonus and a meeting with senior Yahoo executives.

The most recent Super Paranoids worked on security in the new Yahoo Mail= , developed an antiphishing feature and recruited more Par= anoids in Europe.

All of this falls under Bejar's simple definitio<= /st1:PersonName>n for online security. "Alice shouldn't be able to see Bob's e-mail without Bob's consent," Bejar said. That's the more complex definition; he tells his 5-year-old son that he tries to stop the bad guys from reading other people's e-mail.

"He asks if I am a cop and he beli= eves that's what it is, but it is not the way I look at it." Perhaps, but there's no denying that Bejar's natural gumshoe mentality was influenced by digital sleuthi= ng at a young age.=

While growing up in Mexico City, he became interested in comput= ers from playing with so= me Commodores at summer camp. "When I got home afterwards, someone gave my dad a computer with no games, so I learned how to write one," he said.

He began to develop his feel for security after realizing that applications c<= st1:PersonName w:st=3D"on">ould be made to do things the developers had not intended. More inspiration came from reading Clifford Stoll's The Cucko= o's Egg: Tracking a Spy Th= rough the Maze of Computer Espionage, a seminal work in cybercrime nonfiction.

"It spoke about default passwords in certain systems, which my school had, and passwo= rds which administrators did not change, which my school's administrato<= /st1:PersonName>rs had not--and well, you could do a lot with that," Bejar said. "I'm not sure if they ever found out though."

A natural with computers, Bejar started working for IBM when he was in his late teens. A link with Apple co-f= ounder Steve Wozniak, still a good friend of Bejar, subsequently led him to King's College London where he got a degree in mathe= matics while also working at IBM there.

He then moved to the United States to work at a start-up that was building distributed so<= /st1:PersonName>cial systems, a transition that br<= st1:PersonName w:st=3D"on">ought him a step closer to joining Yahoo nearly a decade ago, initially= in billing applications.

"It was ultimately the appeal of h= elping build and protect things that = would be used by many people that got me, and has kept me, = at Yahoo," he said.

It's a noble goal that is, of course, easier said than done. "W= eb applications are available to anyone in the world, so you have to build them to withstand instant scrutiny," Bejar said.

He notes that, in theory, developing secure Web applications isn't = any different from building good desktop software. But early PC programs and operating systems didn't take that access int<= st1:PersonName w:st=3D"on">o account and therefore weren't designed= with constant network connectivity in mind.

Curriculum on security has traditionally focused on topics such as encryption. "Secu= rity was not defined as what happen= s if somebody tries to manipulate your API (applicati= on programming interface) with ma= licious or mischievous intent. Applicati<= st1:PersonName w:st=3D"on">on security has a lot to do with building things that don't behave unexpectedly when by accident or by malice somebody on the outside tries to manipulate them," = Bejar said.

"We were aware of a lot of these problems before they even had names," he added. "= ;When they first came around, there = wasn't any good prior art available so we had to come up with a response ourselves."

That response includes several homemade tools to identify and track potential security issues in the Web site and online applications. One such tool, called Scanmus, hunts for cross-site scripting issues. T= he tool is named after Rasmus Lerdorf, the o= riginal creator of the PHP scripting language and a member of the Yahoo Paranoids.
Others include the Code Ferret, which inspects code and reports bugs to Pepe, a bug-tracking system named after a chara= cter similar to Jiminy Cricket in a= version of Pinocchio.

The to= ols were tailored to work with Yahoo's systems. The company had tried= some commercial applications but found that it would take too much time to retrofit those to fit its needs.

It is a laborious task, but Bejar kno= ws that some things are worth waiting for. When he went to work at Yahoo in 1998, he was restoring a 1973 Porsche Carrera that he named "El Pat= o"--Spanish for "The Duck.&quo= t;

"El Pato was = built as Yahoo to= ok off. I built or rebuilt almost every part of it, under the supervision of Bob, my mechanic," Bejar said. "To some extent, I see El Pato as analogous to my time here at Yahoo. The security pr= ogram has taken time to put together and it requires a lot of thought and understanding of how the different parts interact."

Now he says it may be time for Yahoo to share that hard work outside the company.=

"We're all in this together," Bejar said. "If anything were to happen to any one of us, all are impacted."=

&n= bsp;