3 ms·
Why is there absolutely zero focus on the lack of basic security measures that would prevent a large scale breach like this? The government still doesn't know
by Johnny555 10y ago
Why is there absolutely zero focus on the lack of basic security measures that would prevent a large scale breach like this?
The government still doesn't know exactly what data he walked off with. And while you'd think they'd have stepped up security since then, now Harold T. Martin has again walked off with terabytes of secret data. In both cases, these secrets were stolen by contractors, not even full employees.
I have full admin rights to every server at work, but I can't gain access to customer data without tripping access alarms that notify our security team. How is it possible that the NSA has no similar controls? I realize that such controls can be expensive (in direct costs and ongoing operations), but "with great data comes great responsibility", and if there's any database in the country that needs exceptional controls, it's the NSA's database that is much more valuable than any other corporate database.
How many foreign powers have walked off with even more data undetected because they aren't going to publicize it -- they are likely siphoning off data right now, and the NSA has no idea.
- GunboatDiplomat 10y agoIn part, I think you're overestimating how difficult it would be for you to gain access to customer data covertly, given root access to all the servers at your company.
- beachstartup 10y agoi agree. to some people root still means root which means you can do anything local undetected if you're smart enough (most people aren't). apparently these days it means something else. who knew.
- SixSigma 10y ago"full admin rights"
- Johnny555 10y agoWhen audit logs go to an audit server, you can't do anything undetected, even as root - the initial login, sudo to root and subsequent activity are logged, so even if I log in and kill the audit daemon, that will be detected and tied back to me. If I even log on to one of the audit servers without prior approval, it will page the security team. And if they can't validate why I've logged in there, they'll lock out my account.
- emmelaich 10y agoUhm, you're not using your imagination to put it mildly. There's many ways of getting a plausible deniability. Plus, breaks are never done through the strongest part of the wall. Computers can be made totally secure in management minds, and in the minds of the broader public. We know from stories of break-in after break-in to some of the worlds top companies, that that is a dangerous lie. Most of these break-ins were done without the conscious cooperation of anyone inside who had admin rights. Now, just imagine what can be done calculatedly with admin rights. It comes down to trusting people eventually. It's always about people.
- Johnny555 10y agoIf I could find a zero day exploit that would give me root, that might get me in, but network accesses are logged too, so even if I found a back door way into the server, I'd still be discovered "Johnny, someone altered binaries on our server yesterday, there were no SSH logins, but your VPN session hit our application server port at the exact time the application daemon crashed. Explain?" Even though I have server admin rights, I can't touch the network so I can't open an unaudited path to the server. It's not that the server security will keep me from accessing the data, but it will keep me from accessing it without being discovered.
- Steel_Phoenix 10y agoBeing able to tell who grabbed the data and when is nice, but what's to stop someone who is willing to grab the data and run/leak?
- beachstartup 10y ago"my new home alarm system will tell you with 100% certainty after you get robbed, that you were robbed!"
- astine 10y agoBecause the bureaucracy makes implementing such measures unreasonably difficult. Implementing any kind of new system, even one related to security takes months, even in a simple case and it might takes years for the system to be fully realized. I've worked in federal contracting and have seem stuff like this happen. The whole process is glacial.
- Johnny555 10y agoThey don't seem to have any problem with adding new data sources to their growing pile of data and new data centers to house it, so they can implement proper security controls as well.
- module0000 10y agoIf you have full root access - then you don't go at the customer data directly, that's amateur hour. Think about how the data is stored... is it within LVM of some sort(this is likely)? If so, create a new LV mirrored from the volumes containing customer data. Since you're root, make sure this new block device is absent from tools like 'lsblk' or walking through /dev/mapper. That's just one (poor) suggestion. Never think about bee-lining right towards the valuable data though, that's precisely what every IDS is "best" at detecting. Come at it sideways, so to speak :)
- module0000 10y agoReplying just to add another idea that came to me after hitting submit. Use the network-namespaces feature of linux(assuming this data resides on linux). Then you can create the equivalent of a hidden span-port, letting you inspect all the IP traffic at your leisure - including the traffic that contains customer data.
- Johnny555 10y agoIf someone can snoop traffic and see confidential data, you're not very serious about security - no confidential data is sent off-server without being encrypted. (SSL mostly, with point to point VPN tunnels for a few apps that don't support encryption natively)
- module0000 10y agoThat's very true - if data is leaving unencrypted then they have made a mistake. This is an easy mistake to make though if you bank on your LAN being truly private. However, on the other side of the coin...lots of traffic is unencrypted by design(NFS 1x,2x,3x, and 4x unless you use krb5p, and iscsi).
- Johnny555 10y agoGreat, so now I have an encrypted volume that I can't read unless I can compromise the HSM that stores the keys.