6 ms·

Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. WRT the failings: I've

by m0nty 9y ago

Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. WRT the failings: I've worked in IT in the UK for more than 25 years, and I have never (until now) worked in a place that took security seriously. That includes schools, a large accountancy firm, several well-known public sector establishments, a political campaign, etc. "Optimistic security" is the model here, and hospitals have huge rambling networks with many legacy systems and third-party solutions. I would be surprised if they don't have security issues. Where they are secure, it's probably down to some unsung hero(es) somewhere, who took it on themselves to push security. (I've done this myself and it's a thankless task; nobody notices or cares. Dogs not barking, etc.)

gadders 9y ago
Investment Banks take it seriously. So seriously some clown in IT Sec cut off the links to 3rd party libraries from the internal Nexus.
thecosas 9y ago
Ars story: https://arstechnica.com/information-technology/2017/05/nhs-ransomware-cyber-attack/ https://arstechnica.com/information-technology/2017/05/nhs-r...
lol768 9y ago
> Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. That's a good point, tech journalism is usually pretty poor. https://twitter.com/ShaunLintern/status/863039464649744384 https://twitter.com/ShaunLintern/status/863039464649744384 suggests it's significantly more boring than a zero-day (though still incredibly problematic). Your experiences with UK IT make for depressing reading.
- m0nty 9y ago
  > Your experiences with UK IT make for depressing reading. I am astonished that even skilled techies don't take security seriously, using passwords like their car registration or company name - I've seen that with a military contractor, ffs. People who had signed the Official Secrets Act and had network links into supposedly secure sites. It depresses me too.
  - graphitezepp 9y ago
    From my perspective its a fundamental problem with incentives. Good security costs time and money, never gets return gains, and no one will put money up that wont ever see a ROI. So incredibly short sighted, depressing indeed.
  - sqeaky 9y ago
    People have this insane notion that one line of defense is enough or they have the equally insane notion that no wants to take something they have. People have a really hard time evaluating simple risk/reward models. You have to make the reward of attacking you higher than any possible reward to have a reasonable chance at security. If anyone anywhere on the Internet can profit by your loss, eventually someone will try. EDIT - To make life even more difficult sometimes the attack provides gains indirectly. Imagine one group of politicians attacking a service supported by another political faction, just that service going down profits the first group if it changes who voters vote for.
mavhc 9y ago
Is there some kind of saying: You can't secure a network that contains legacy systems? Start from scratch, don't connect anything legacy. Assume the LAN is already penetrated and design for that. Store no data locally, client machines run something like ChromeOS by default. Timeout anything that's not used for 6 months. Don't use passwords, only SmartCards. Snapshot data for ease of restore.
- candiodari 9y ago
  Don't you think that, perhaps, replacing a dependency on a centralized infrastructure by replacing the entire system by centralized infrastructure, owned by a foreign company, might not be the smartest idea ? Systems that can't depend on the outside, obviously, cannot use cloud services. That means no chromeOS, no active directory, nothing but the local network. This is beyond obvious, and yet, I actually believe we'll be stupid enough to do exactly the centralization thing. Paying $300 to these crooks, incidentally, will be a LOT cheaper than whatever microsoft or any other company will ask for the centralized infrastructure. Not that I suggest doing that, but still.
  - mavhc 9y ago
    I did say something like, just take ChromiumOS and your run own servers. All systems depend on the outside to some extent anyway. Is it $300, or $300 per machine? Why can't the machines just be reimaged, what kind of giant corporation doesn't have that working automatically?
    - candiodari 9y ago
      $300 per machine. Issue is that ransomware also encrypts all files on shared drives. But a problem with the approach of centralization taken by something like ChromeOS which uses Google accounts (or I guess Win10S which uses ms accounts) is that you're attempting to prevent one player from holding you hostage by giving yourself hostage to another. This is not going to work to prevent paying through the nose, although yes, your new hostage takers will probably realize that the NHS will be able to pay more when it actually takes care of patients. Not too well, of course, good enough to make sure it isn't replaced or repealed. Badly enough so that constant complaints ensure a fresh budget injection every quarter.

by m0nty 9y ago

gadders 9y ago

Investment Banks take it seriously. So seriously some clown in IT Sec cut off the links to 3rd party libraries from the internal Nexus.

thecosas 9y ago

Ars story: https://arstechnica.com/information-technology/2017/05/nhs-ransomware-cyber-attack/ https://arstechnica.com/information-technology/2017/05/nhs-r...

lol768 9y ago

> Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. That's a good point, tech journalism is usually pretty poor. https://twitter.com/ShaunLintern/status/863039464649744384 https://twitter.com/ShaunLintern/status/863039464649744384 suggests it's significantly more boring than a zero-day (though still incredibly problematic). Your experiences with UK IT make for depressing reading.

m0nty 9y ago
> Your experiences with UK IT make for depressing reading. I am astonished that even skilled techies don't take security seriously, using passwords like their car registration or company name - I've seen that with a military contractor, ffs. People who had signed the Official Secrets Act and had network links into supposedly secure sites. It depresses me too.
- graphitezepp 9y ago
  From my perspective its a fundamental problem with incentives. Good security costs time and money, never gets return gains, and no one will put money up that wont ever see a ROI. So incredibly short sighted, depressing indeed.
- sqeaky 9y ago
  People have this insane notion that one line of defense is enough or they have the equally insane notion that no wants to take something they have. People have a really hard time evaluating simple risk/reward models. You have to make the reward of attacking you higher than any possible reward to have a reasonable chance at security. If anyone anywhere on the Internet can profit by your loss, eventually someone will try. EDIT - To make life even more difficult sometimes the attack provides gains indirectly. Imagine one group of politicians attacking a service supported by another political faction, just that service going down profits the first group if it changes who voters vote for.

mavhc 9y ago

Is there some kind of saying: You can't secure a network that contains legacy systems? Start from scratch, don't connect anything legacy. Assume the LAN is already penetrated and design for that. Store no data locally, client machines run something like ChromeOS by default. Timeout anything that's not used for 6 months. Don't use passwords, only SmartCards. Snapshot data for ease of restore.

candiodari 9y ago
Don't you think that, perhaps, replacing a dependency on a centralized infrastructure by replacing the entire system by centralized infrastructure, owned by a foreign company, might not be the smartest idea ? Systems that can't depend on the outside, obviously, cannot use cloud services. That means no chromeOS, no active directory, nothing but the local network. This is beyond obvious, and yet, I actually believe we'll be stupid enough to do exactly the centralization thing. Paying $300 to these crooks, incidentally, will be a LOT cheaper than whatever microsoft or any other company will ask for the centralized infrastructure. Not that I suggest doing that, but still.
- mavhc 9y ago
  I did say something like, just take ChromiumOS and your run own servers. All systems depend on the outside to some extent anyway. Is it $300, or $300 per machine? Why can't the machines just be reimaged, what kind of giant corporation doesn't have that working automatically?
  - candiodari 9y ago
    $300 per machine. Issue is that ransomware also encrypts all files on shared drives. But a problem with the approach of centralization taken by something like ChromeOS which uses Google accounts (or I guess Win10S which uses ms accounts) is that you're attempting to prevent one player from holding you hostage by giving yourself hostage to another. This is not going to work to prevent paying through the nose, although yes, your new hostage takers will probably realize that the NHS will be able to pay more when it actually takes care of patients. Not too well, of course, good enough to make sure it isn't replaced or repealed. Badly enough so that constant complaints ensure a fresh budget injection every quarter.