5 ms·

The point is, you can hold them to whatever standard you want to. We collectively have not figured out any techniques to achieve the goal: to be impervious, alw

The point is, you can hold them to whatever standard you want to. We collectively have not figured out any techniques to achieve the goal: to be impervious, always. And that's what you demand (or "require," as patio is fond of saying). You can disagree with that, but you'd be hard-pressed to justify that position. Six decades of computing history would contradict you. And as someone who saw the landscape of real-world codebases and deployments at nearly a hundred companies, there is almost always a way in. People are smug thinking their code is great till you show them an SQL injection that works, or pop up an alert(1) on their favorite front end framework. The moment the world freaks out about this lack of security, we've all lost. Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees. You might think that's how it already is, but we can move way farther in that direction. Just look at how hard it is to run a simple medical study.

Alain-lf 9y ago
Nobody is asking for perfect security. We just expect a company that stores the highly personal information of hundreds of millions of people to have better security than that of a random blog site maintained by one guy in his basement.
- sillysaurus3 9y ago
  Well, you are asking for perfect security. Everyone here is. That's what it means not to ever be breached. I think that's the uncomfortable truth we've obscured. We are asking for the impossible. If you don't feel that way, I propose asking some of your pentester friends how they feel about the breach. Somewhere between unsurprised and shrug, probably. It doesn't change a thing that this situation demands higher security. We're fighting against forces of nature. Except instead of extinguishing forest fires, we're asking for the equivalent of no forest fires, ever, and arguing vehemently that modern technology is so good that forest fires should not have been allowed to happen.
  - Alain-lf 9y ago
    > Well, you are asking for perfect security. No need to read the rest of your comment. I'm not biting.
  - sasas 9y ago
    Here they left the door wide open. Google does not leave the door wide open. Google does not have perfect security. But we expect them to make the cost to an attacker high enough that it requires massive investment for a successful breach. Why should we expect less for a company that keeps 140+ million customer records?
jacobsenscott 9y ago
They can be held to a much higher standard than this - a system that can leak all the sensitive data due to an error in the web app. You are describing an amateur architecture where there is a web app directly communicating with a database of sensitive information, and that web app has full access to the database. No experienced developer would do that.
- sillysaurus3 9y ago
  And what would they do? Everyone either goes silent or describes an idealized architecture that has glaringly obvious flaws in regards to meeting business goals. I think maybe the top ten companies in our industry do this at scale well enough to work. Maybe.
  - sasas 9y ago
    1) keep an asset register up to date. This would include libraries used. 2) subscribe to a service that alerts on vulnerabilities in the assets listed in 1). Run Nessus scans. License cost you a bit over $1k a year. 3) invest in a resource to maintain the register and respond to alerts. Tie them into a governance model so management are aware of risks and can divert time and money when needed to mitigate Security is a process not a technology. Nothing I've mentioned here is sexy or advanced.
kibwen 9y ago
> We collectively have not figured out any techniques to achieve the goal: to be impervious, always. What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all. The legal consequences of a leak will be moderated if it is proven, by fellow professionals, that a company took every standard precaution necessary based upon the sensitivity of the data in question. Nobody (except for perhaps yourself) seems to be claiming that Equifax's technical chops were anything but inept. > Six decades of computing history would contradict you. Feel free to actually cite anything at all supporting your position, rather than glibly appealing to inevitability. > The moment the world freaks out about this lack of security, we've all lost. As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order. > Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees. I welcome this dystopia with open arms, if it means it can save us from defeatists who have given up on the idea that software doesn't have to be completely terrible.
- sillysaurus3 9y ago
  What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all. I have personally breached companies that fit this description. That was my job, and it's why I was hopefully the last person to breach that particular facet of their landscape. But pentests can't catch everything. That's the dirty secret that is also somehow not a secret. The very next commit could make that pentest obsolete. Ditto for spinning up a server. As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order. Well, what do you think will happen from this? That may be true, yet the world will go on. We've been trained to accept the current system as inevitable, but SSNs aren't a security mechanism. The underlying absurdity is that we view leaking them as a disaster rather than recognizing and replacing the fact that we all rely on their secrecy. If someone wants to impersonate your identity, they can usually find a way. This breach will certainly make that easier, but I'm not sure it will affect the actual fraud rate. Time will tell. (I'm aware far more than SSNs were leaked. The point is that it was a bad idea to have this central point of failure in the first place. If it wasn't Equifax, it would've been someone else.)

Alain-lf 9y ago

Nobody is asking for perfect security. We just expect a company that stores the highly personal information of hundreds of millions of people to have better security than that of a random blog site maintained by one guy in his basement.

sillysaurus3 9y ago
Well, you are asking for perfect security. Everyone here is. That's what it means not to ever be breached. I think that's the uncomfortable truth we've obscured. We are asking for the impossible. If you don't feel that way, I propose asking some of your pentester friends how they feel about the breach. Somewhere between unsurprised and shrug, probably. It doesn't change a thing that this situation demands higher security. We're fighting against forces of nature. Except instead of extinguishing forest fires, we're asking for the equivalent of no forest fires, ever, and arguing vehemently that modern technology is so good that forest fires should not have been allowed to happen.
- Alain-lf 9y ago
  > Well, you are asking for perfect security. No need to read the rest of your comment. I'm not biting.
- sasas 9y ago
  Here they left the door wide open. Google does not leave the door wide open. Google does not have perfect security. But we expect them to make the cost to an attacker high enough that it requires massive investment for a successful breach. Why should we expect less for a company that keeps 140+ million customer records?

jacobsenscott 9y ago

They can be held to a much higher standard than this - a system that can leak all the sensitive data due to an error in the web app. You are describing an amateur architecture where there is a web app directly communicating with a database of sensitive information, and that web app has full access to the database. No experienced developer would do that.

sillysaurus3 9y ago
And what would they do? Everyone either goes silent or describes an idealized architecture that has glaringly obvious flaws in regards to meeting business goals. I think maybe the top ten companies in our industry do this at scale well enough to work. Maybe.
- sasas 9y ago
  1) keep an asset register up to date. This would include libraries used. 2) subscribe to a service that alerts on vulnerabilities in the assets listed in 1). Run Nessus scans. License cost you a bit over $1k a year. 3) invest in a resource to maintain the register and respond to alerts. Tie them into a governance model so management are aware of risks and can divert time and money when needed to mitigate Security is a process not a technology. Nothing I've mentioned here is sexy or advanced.

kibwen 9y ago

> We collectively have not figured out any techniques to achieve the goal: to be impervious, always. What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all. The legal consequences of a leak will be moderated if it is proven, by fellow professionals, that a company took every standard precaution necessary based upon the sensitivity of the data in question. Nobody (except for perhaps yourself) seems to be claiming that Equifax's technical chops were anything but inept. > Six decades of computing history would contradict you. Feel free to actually cite anything at all supporting your position, rather than glibly appealing to inevitability. > The moment the world freaks out about this lack of security, we've all lost. As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order. > Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees. I welcome this dystopia with open arms, if it means it can save us from defeatists who have given up on the idea that software doesn't have to be completely terrible.

sillysaurus3 9y ago
What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all. I have personally breached companies that fit this description. That was my job, and it's why I was hopefully the last person to breach that particular facet of their landscape. But pentests can't catch everything. That's the dirty secret that is also somehow not a secret. The very next commit could make that pentest obsolete. Ditto for spinning up a server. As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order. Well, what do you think will happen from this? That may be true, yet the world will go on. We've been trained to accept the current system as inevitable, but SSNs aren't a security mechanism. The underlying absurdity is that we view leaking them as a disaster rather than recognizing and replacing the fact that we all rely on their secrecy. If someone wants to impersonate your identity, they can usually find a way. This breach will certainly make that easier, but I'm not sure it will affect the actual fraud rate. Time will tell. (I'm aware far more than SSNs were leaked. The point is that it was a bad idea to have this central point of failure in the first place. If it wasn't Equifax, it would've been someone else.)