4 ms·

> But nobody should pretend that RCE on an on-prem webserver wouldn't be game-over, The system/network I inherited at new job it absolutely would be, it won't

> But nobody should pretend that RCE on an on-prem webserver wouldn't be game-over, The system/network I inherited at new job it absolutely would be, it won't be in a year though. We aren't a fortune 500 but there are simple, practical things you can do to limit the damage an RCE on a webserver can actually do.

tptacek 9y ago
Everybody can lock down a small network. Empirically, very few security teams can manage that for large networks with large numbers of stakeholders.
- chris_wot 9y ago
  Then systems of governance are utterly broken and management should step in to enforce remedial actions, ASAP. But I disagree, security teams can and should manage large networks with large numbers of stakeholders.
  - tptacek 9y ago
    If they can, why don't they? How many annual site-wide pentests have you heard of that failed hard? And those are the people savvy enough to conduct annual site-wide pentests!
    - extrapickles 9y ago
      A common pentest isn't geared towards discovering architectural weaknesses like all Americans PII is one popped webserver away from disclosure. What's needed is an architectural security review, which is even rarer than people conducting an annual pentest.
      - tptacek 9y ago
        What's your point? I'm saying, sitewide pentests almost always succeed.
        chris_wot 9y ago
        So they keep going till they fail?
        tptacek 9y ago
        I don't understand your question. When I say a pentest succeeds, I mean that the testers succeeded in compromising their objective.
        pas 9y ago
        Parent post is saying that that should constitute a failed audit. And it should be repeated as long as a 2 week effort by a pentesting team yields results.
        chris_wot 9y ago
        So they plug the security holes, arrange a new pentest.
        wglb 9y ago
        The target for most network pen tests is to obtain domain by noon of the first day. Generally, they keep going until they succeed and/or someone in the chain cries uncle.
    - michaelt 9y ago
      If they can, why don't they? Insufficient incentives, either caused by inadequate regulation or a belief the regulation won't be enforced. Think of the standards of network security and software validation used by, say, a Certificate Authority to keep their root certificates safe. Or by Google to secure GMail. Equifax just hasn't made reaching that standard their highest priority.
      - tptacek 9y ago
        Certificate authorities to keep their root certificate keys safe... hmm... do go on. :) Google would be most people's exception to the rule I'm talking about here, having as they do one of the world's greatest information security teams. And Google has had major incidents!
- lomnakkus 9y ago
  > Everybody can lock down a small network. You're too optimistic :(

tptacek 9y ago

Everybody can lock down a small network. Empirically, very few security teams can manage that for large networks with large numbers of stakeholders.

chris_wot 9y ago
Then systems of governance are utterly broken and management should step in to enforce remedial actions, ASAP. But I disagree, security teams can and should manage large networks with large numbers of stakeholders.
- tptacek 9y ago
  If they can, why don't they? How many annual site-wide pentests have you heard of that failed hard? And those are the people savvy enough to conduct annual site-wide pentests!
  - extrapickles 9y ago
    A common pentest isn't geared towards discovering architectural weaknesses like all Americans PII is one popped webserver away from disclosure. What's needed is an architectural security review, which is even rarer than people conducting an annual pentest.
    - tptacek 9y ago
      What's your point? I'm saying, sitewide pentests almost always succeed.
      - chris_wot 9y ago
        So they keep going till they fail?
        tptacek 9y ago
        I don't understand your question. When I say a pentest succeeds, I mean that the testers succeeded in compromising their objective.
        pas 9y ago
        Parent post is saying that that should constitute a failed audit. And it should be repeated as long as a 2 week effort by a pentesting team yields results.
        chris_wot 9y ago
        So they plug the security holes, arrange a new pentest.
        wglb 9y ago
        The target for most network pen tests is to obtain domain by noon of the first day. Generally, they keep going until they succeed and/or someone in the chain cries uncle.
  - michaelt 9y ago
    If they can, why don't they? Insufficient incentives, either caused by inadequate regulation or a belief the regulation won't be enforced. Think of the standards of network security and software validation used by, say, a Certificate Authority to keep their root certificates safe. Or by Google to secure GMail. Equifax just hasn't made reaching that standard their highest priority.
    - tptacek 9y ago
      Certificate authorities to keep their root certificate keys safe... hmm... do go on. :) Google would be most people's exception to the rule I'm talking about here, having as they do one of the world's greatest information security teams. And Google has had major incidents!
lomnakkus 9y ago
> Everybody can lock down a small network. You're too optimistic :(