4 ms·

Is there some kind of saying: You can't secure a network that contains legacy systems? Start from scratch, don't connect anything legacy. Assume the LAN is alr

by mavhc 9y ago

Is there some kind of saying: You can't secure a network that contains legacy systems? Start from scratch, don't connect anything legacy. Assume the LAN is already penetrated and design for that. Store no data locally, client machines run something like ChromeOS by default. Timeout anything that's not used for 6 months. Don't use passwords, only SmartCards. Snapshot data for ease of restore.

candiodari 9y ago
Don't you think that, perhaps, replacing a dependency on a centralized infrastructure by replacing the entire system by centralized infrastructure, owned by a foreign company, might not be the smartest idea ? Systems that can't depend on the outside, obviously, cannot use cloud services. That means no chromeOS, no active directory, nothing but the local network. This is beyond obvious, and yet, I actually believe we'll be stupid enough to do exactly the centralization thing. Paying $300 to these crooks, incidentally, will be a LOT cheaper than whatever microsoft or any other company will ask for the centralized infrastructure. Not that I suggest doing that, but still.
- mavhc 9y ago
  I did say something like, just take ChromiumOS and your run own servers. All systems depend on the outside to some extent anyway. Is it $300, or $300 per machine? Why can't the machines just be reimaged, what kind of giant corporation doesn't have that working automatically?
  - candiodari 9y ago
    $300 per machine. Issue is that ransomware also encrypts all files on shared drives. But a problem with the approach of centralization taken by something like ChromeOS which uses Google accounts (or I guess Win10S which uses ms accounts) is that you're attempting to prevent one player from holding you hostage by giving yourself hostage to another. This is not going to work to prevent paying through the nose, although yes, your new hostage takers will probably realize that the NHS will be able to pay more when it actually takes care of patients. Not too well, of course, good enough to make sure it isn't replaced or repealed. Badly enough so that constant complaints ensure a fresh budget injection every quarter.
    - mavhc 9y ago
      They're already being held hostage by 1000s of companies who won't update their crappy software so it runs properly, allowing them to install OS updates rapidly. As I said, like ChromeOS, it's perfectly possible to run your own servers, don't need to pay Google or Microsoft. https://www.chromium.org/developers/how-tos/enterprise/running-the-cloud-policy-test-server https://www.chromium.org/developers/how-tos/enterprise/runni...
m0nty 9y ago
> Start from scratch, don't connect anything legacy The myth of the clean sweep. Personally, I've found such systems tend to be late, wrong and inevitably end up resembling what they replace, warts-and-all. This is because systems tend to mirror the organisational and political context they are in, and most programmers today are not significantly better than those who came before them. Quote me all the exceptions you like, this is my experience. https://en.wikipedia.org/wiki/Conway's_law https://en.wikipedia.org/wiki/Conway's_law

by mavhc 9y ago

candiodari 9y ago

Don't you think that, perhaps, replacing a dependency on a centralized infrastructure by replacing the entire system by centralized infrastructure, owned by a foreign company, might not be the smartest idea ? Systems that can't depend on the outside, obviously, cannot use cloud services. That means no chromeOS, no active directory, nothing but the local network. This is beyond obvious, and yet, I actually believe we'll be stupid enough to do exactly the centralization thing. Paying $300 to these crooks, incidentally, will be a LOT cheaper than whatever microsoft or any other company will ask for the centralized infrastructure. Not that I suggest doing that, but still.

mavhc 9y ago
I did say something like, just take ChromiumOS and your run own servers. All systems depend on the outside to some extent anyway. Is it $300, or $300 per machine? Why can't the machines just be reimaged, what kind of giant corporation doesn't have that working automatically?
- candiodari 9y ago
  $300 per machine. Issue is that ransomware also encrypts all files on shared drives. But a problem with the approach of centralization taken by something like ChromeOS which uses Google accounts (or I guess Win10S which uses ms accounts) is that you're attempting to prevent one player from holding you hostage by giving yourself hostage to another. This is not going to work to prevent paying through the nose, although yes, your new hostage takers will probably realize that the NHS will be able to pay more when it actually takes care of patients. Not too well, of course, good enough to make sure it isn't replaced or repealed. Badly enough so that constant complaints ensure a fresh budget injection every quarter.
  - mavhc 9y ago
    They're already being held hostage by 1000s of companies who won't update their crappy software so it runs properly, allowing them to install OS updates rapidly. As I said, like ChromeOS, it's perfectly possible to run your own servers, don't need to pay Google or Microsoft. https://www.chromium.org/developers/how-tos/enterprise/running-the-cloud-policy-test-server https://www.chromium.org/developers/how-tos/enterprise/runni...

m0nty 9y ago

> Start from scratch, don't connect anything legacy The myth of the clean sweep. Personally, I've found such systems tend to be late, wrong and inevitably end up resembling what they replace, warts-and-all. This is because systems tend to mirror the organisational and political context they are in, and most programmers today are not significantly better than those who came before them. Quote me all the exceptions you like, this is my experience. https://en.wikipedia.org/wiki/Conway's_law https://en.wikipedia.org/wiki/Conway's_law