Podcast
Root Causes 261: Why I Don't Say Spoof


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
December 13, 2022
The word spoof is a security industry term used in the context of social engineering attacks. In this episode we explore the word's connotations in different walks of life and why its connotations may not serve us well when applied to security concerns.
Podcast Transcript
Lightly edited for flow and brevity.
And in the world of PKI and trust models and Alice and Bob and all that stuff that you and I have been talking about for decades, this word spoof has been brought in when a digital entity, usually an email or a website, but it really could be any digital entity, pretends to be a different digital entity for purposes of deceiving. And as such, it’s fundamentally deceptive. There is a judgment associated with it. It’s dishonest. It’s an attack. But spoof itself is a neutral word. It just means an act and this is where I start to have the problem with it because in all walks of life except the world of online identity, threats, social engineering, Alice and Bob and all that stuff, in all the rest of the world, spoof actually has very positive connotations. If you listen to a weird Al Yankovic song, it’s a spoof of a popular song and we all have a good time and we laugh. And if you watch a funny movie, if you remember Airplane, that was a spoof of the movie Airport. And we all had a good time and we laughed. And for those of us who are old enough, we used to read Mad Magazine and it was full of all kinds of spoofs of other things that were popular in the media at the time, and we all had a good time and we laughed. So, if you talk to a non-security professional, spoof is a good thing. But if you talk to a security professional, spoof is a bad thing and I personally find this disconnection cognitively dissonant. I just find it jarring. When I read spoof, when I say spoof, I fear that we are underplaying the maliciousness of the activity because all of these other associations are in all of our minds.
Again, I understand. If you look at the dictionary, it’s a neutral word. But I think that in the real-world usage of a modern 21st century westerner, it is not a neutral word. And so, that’s always bothered me and so, I’ve done a lot of writing and speaking and presenting and things over the years in this particular world and category and it’s just a word I don’t like, and I mostly don’t use.
So, that’s it. Short and sweet but it’s something that thought I would get out there into the dialogue because it’s something I’ve felt for a long time.

