7 ms·

> But nobody should pretend that RCE on an on-prem webserver wouldn't be game-over, for the entire internal network, across the majority of the Fortune 100. Yo

> But nobody should pretend that RCE on an on-prem webserver wouldn't be game-over, for the entire internal network, across the majority of the Fortune 100. You certainly have more experience with this than the vast majority of the rest of us, but with that kind of data on millions of people, shouldn't it be, and why isn't it, standard practice to put servers storing that data behind an extremely limited API, with a firewall in place to monitor queries and responses and severely rate-limit or stop additional traffic if something suspicious happens, until the monitoring people can take a look?

tptacek 9y ago
Because that not only adds operational expense but also requires engineering teams to have a level of systems engineering expertise and diligence that virtually no line-of-business software project has.
- ethbro 9y ago
  *adds operational expense without a counterparty willing to pay for that expense Those with data on Equifax's servers aren't Equifax's customers, so other than "not having a PR cluster&#@_" economic incentives are not aligned to prevent this.
  - sillysaurus3 9y ago
    It's probably best to treat Equifax specially rather than making an example out of them for the rest of the industry to follow.
    - concede_pluto 9y ago
      If they aren't qualified to design with least privilege, what are they qualified for, beyond maybe cat videos?
      - tptacek 9y ago
        I've spent about half my professional career finding vulnerabilities in the software of developers who are convinced they're "qualified to design with least privilege".
- pacaro 9y ago
  And, even if you know what you are doing, this is intrinsically a hard problem, you need to know exactly what information should be accessible to each server
stickfigure 9y ago
You can add all the security layers you want, but if the web server needs to display a piece of information, the web server must have access to that information. The keys must be in the car somewhere. Also... even with multiple layers, what do you think the backend stack would be? Unless it's built by a separate team deliberately using a different technology platform, you're stuck with the same Struts (or whatever) vulnerability.

tptacek 9y ago

Because that not only adds operational expense but also requires engineering teams to have a level of systems engineering expertise and diligence that virtually no line-of-business software project has.

ethbro 9y ago
*adds operational expense without a counterparty willing to pay for that expense Those with data on Equifax's servers aren't Equifax's customers, so other than "not having a PR cluster&#@_" economic incentives are not aligned to prevent this.
- sillysaurus3 9y ago
  It's probably best to treat Equifax specially rather than making an example out of them for the rest of the industry to follow.
  - concede_pluto 9y ago
    If they aren't qualified to design with least privilege, what are they qualified for, beyond maybe cat videos?
    - tptacek 9y ago
      I've spent about half my professional career finding vulnerabilities in the software of developers who are convinced they're "qualified to design with least privilege".
pacaro 9y ago
And, even if you know what you are doing, this is intrinsically a hard problem, you need to know exactly what information should be accessible to each server

stickfigure 9y ago

You can add all the security layers you want, but if the web server needs to display a piece of information, the web server must have access to that information. The keys must be in the car somewhere. Also... even with multiple layers, what do you think the backend stack would be? Unless it's built by a separate team deliberately using a different technology platform, you're stuck with the same Struts (or whatever) vulnerability.