6 ms·

When two people are clearly intelligent but disagree, the reason is almost always a different set of experiences. My experience differs from yours; if I could V

When two people are clearly intelligent but disagree, the reason is almost always a different set of experiences. My experience differs from yours; if I could Vulcan my brain to yours, you'd see why I feel this way. You might still disagree, but it would be far less clear cut. Now, I've seen nearly a hundred codebases and they all looked pretty much like Equifax. I don't even need to see Equifax to know the kind of disaster their codebase facilitated. Equifax's codebase is your code, and my code, and Bob's code. The only way to make this situation better is to talk openly about it. And the best way to do that is to actively defend the unpopular side in order to call attention to uncomfortable truths. It's a calculated strategy. Just because you worked at a place with good security hygiene, it makes no difference to the world at large. Everybody else looks like Equifax. We need to (a) acknowledge that and (b) actively seek out solutions. That's what's happening here. Ask yourself: "Why do I disagree when I've seen one or two enterprise codebases?" Those big, plodding institutions you mention are similarly vulnerable. Everyone is. Why aren't data breaches happening almost daily? Because it's illegal. It's no coincidence that companies with public bug bounties are among the hardest targets to hit. When you make it not-illegal to attack you, surprise: you find the vulns. A good question is, "is it illegal for a white hat to attack my business?" If the answer is yes, seek to change that. It's a low effort thing that will increase your security posture. But it's no substitute for $40k pentests.

js2 9y ago
> Everybody else looks like Equifax. I don't doubt that there are other Equifaxes out there, nor do I doubt that there will be more leaks. But this wasn't a simple matter of a horrible code base. Heck, the leak wasn't even due to Equifax code, it was due to third party code. Other companies of Equifax's size apparently do better. Equifax should have done better, and I'll bet if the penalties for losing this data were more severe, would have done better.
- sillysaurus3 9y ago
  You can bet all you want. Your head will roll next, after Equifax and everyone else you decide to demonize. Once the avalanche starts, it won't stop. Know what happens when you demonize something? People stop reporting it. Look at the actual damage to actual people. You are arguing for prison time for the execs, if I remember correctly. Yet it's unclear that a single person has yet been materially damaged by these leaks. If you want to suck away N years of someone's life, you have a higher bar to clear.
  - js2 9y ago
    (Meta: I think we edited our replies past each other.) I haven't commented on the Equifax incident, so you're confusing me for someone else. I don't have an opinion one way or the other on criminal negligence. How do we incentivize (or regulate?) companies to do a better job handling confidential data?
    - sillysaurus3 9y ago
      Ah, gotcha. Isn't it a bit scary seeing people argue for prison time for this? It's pretty easy to imagine webdevs becoming the actual targets / scapegoats rather than the execs. A note of "Well, let's not be too hasty" would seem to be in order. Part of the problem is that security breaches matter, but they don't matter. It's like the negative externality of factory pollution. One day perhaps the effects will become visible, but this disaster is about as bad as you can get and it's still not obvious that a lot of people are going to lose anything significant from the breach. If someone wanted to impersonate you, they can usually find a way already. Of course, if the 140M SSNs become public, that will change the situation completely. Possibly even for the better: then we'd finally stop relying on them to be secret when they were never designed to be. Believe it or not, the situation now is drastically better than it was a decade ago. People care about getting pentests now. You can grudgingly force a company to fork over the money. One of the best ways to get companies to become more secure is to force them. Most of the companies who were being pentested didn't want to be; they were forced to, because some other business refused to do business with them until they produced a document stating they were reasonably secure. This special document is only obtainable from a security firm; hence, pentests happen, and the world is marginally more secure.
      - deleted 9y ago
        [deleted]
      - jonmb 9y ago
        From what I've seen people want jail time because of the insider stock trading, not because of the security problem itself. So a webdev wouldn't be responsible unless they also engaged in insider trading.
- sillysaurus3 9y ago
  (replying to your "What if $40k for a pentest becomes a rubber stamp?" question, which was an important observation) Mm, it can become that. It's important to get a pentest from a reputable firm. At the one I worked at, it was a point of pride to come up with clever attacks. We'd make a sport of it and try to one-up each other. But it's easy to imagine some other pentest firm just going through the motions, running Nessus and calling it a day. Unfortunately, that's where money really does make a difference. $40k is at the low end of how absurdly expensive pentests are. Yet they make all the difference -- one app that I pentested was at a trading firm. I took that app from "typing ' leads to SQLi in their Node backend," and "there was SQLi in their Java backend if you were clever" to "you'd have to be more clever than me if you want to breach this app." Most attacks come from unsophisticated adversaries. This implies that raising the bar higher than these guys gets you 80% of the way home. The other 20% is much harder, but it's doable if your company has a culture of caring about security.
  - js2 9y ago
    Thanks for replying and sorry for moving my comment.
    - sillysaurus3 9y ago
      It's all good. Just happy the world is starting to care about security.
- yebyen 9y ago
  > I think that more and more CISOs are becoming comfortable with the cloud and companies are insisting that CISOs become comfortable. So I always say that given enough time, we can secure anything and find a way to say yes to it and business-driven CISOs are of that mind. > If a CISO can come up with a list of controls that he/she is comfortable with, then by and large the evidence proves that those controls are working effectively and are going to satisfy the elements of any framework that you use. These are two soundbites from an interview with Susan Mauldin from over a year ago. Someone didn't want us to hear them, according to the timeline[1] of when someone remembered and reported that these interviews happened on September 9, and how soon after (on September 10) they were taken down (and then late last night, at least partially recovered again, further on down in this very HN thread!) They are not even especially damning soundbites if you put them out of context and honestly evaluate them in a vacuum, but it does put some additional context on "it was due to third party code" and in the context of this whole discussion, it is clear why someone did not want us to see this interview. If the job of the CISO is to deliver the project under budget and on time, rather than to do the job correctly as you and I understand it, then we are certainly more likely to find ourselves in this position. So let's keep having these discussions and make it better! It is absolutely your codebase and my codebase, we are all in this kind of trouble (or, we could be... if we all similarly had 140 million involuntary "customers" entrusting us with their SSNs and credit histories.) [1]: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic...
  - karlkatzke 9y ago
    > If the job of the CISO is to deliver the project under budget and on time, rather than to do the job correctly as you and I understand it, then we are certainly more likely to find ourselves in this position The same fault is responsible for the Space Shuttle Columbia crash. It's called "leadership without vision." If you put a manager in place and give them tight constraints on how they deliver the product, they will almost universally deliver a critically flawed product ... albeit, on time and under budget.
deleted 9y ago
[deleted]
code_duck 9y ago
Why would all of the various criminal organizations across the world be deterred by something being illegal? The logic you have laid out makes it sound like only white hats would ever try to attack a credit agency. I'm pretty sure by the definition of black hat, and criminal organization, if these companies have something they want, and they have a technical means to get it, the fact that it's illegal is not a deterrent, it's actually their business model.
- sillysaurus3 9y ago
  The vast majority of adversaries are incompetent or unmotivated. It's why breaches don't happen daily. Look at it this way: If you get a pentest, you will immediately discover there were glaring security flaws that an attacker could have used to get into your network. This isn't true in every case, but for example I can count on one hand the number of companies I didn't get at least an XSS against. I had no magic. I'm just a guy using Burp suite, working together with someone else using Burp suite. When two talented people work together to break your stuff, they pull out rabbits that nobody knew existed. Especially when they've been doing it full time every day for a year. I'm sure black hats have talented people at their disposal. But they are selective. Launching a real operation against a US target is risky unless you live in Russia or work in China's army. And while it's valuable for Russian black hats to swipe Equifax's PII, other data troves typically aren't valuable enough to target. To put it another way, if Russians got into Facebook, so what? They'd get everyone's sultry private messages. Yet Facebook cares more about security than almost anyone else. That's why it's almost impossible to swipe their data. The vast majority of companies are in the "If Russians got in, it doesn't really matter; also we don't care" category. These are the mom and dad shops that use duct tape and glue for their payment processing. Above this are our companies: If Russians got in, it would be a minor disaster, but we care about preventing it. Except usually we don't care enough to put down $40k. Then you have companies like Equifax. The worst of both worlds: They weren't careful enough with their security, and it was an unprecedented disaster when someone got in. Yet even here, it's unclear how much this unprecedented disaster is going to materially harm people. Will those 140M SSNs show up on the black market for sale? Who will pay for them, and how much? (Hopefully it will be posted in full, in clear text, so we can all switch away from the stupid SSN system we've been relying on.) So when it's a combination of not too valuable to attack you, very costly to improve your defenses, and not too harmful if you screw up, you get the present world: ~everybody is vulnerable, but few companies care enough to pay more than lip service. Why would they? Even if they lost everyone's data tomorrow, it would be little more than egg on their face. This situation is changing, slowly. If the diff between 2008 and 2018 is like 2018 to 2028, we will be in excellent shape. But we have to avoid falling into traps like mandating regulation at every company, or sending people to prison. Those are tempting but misguided efforts: regulation would reduce the effectiveness of pentests, and sending people to prison will cause security breaches never to be reported. It will be hard, particularly when the world reacts like this: https://i.imgur.com/g01f9vV.png https://i.imgur.com/g01f9vV.png But companies like Apple are paving the way forward. Even if they help no other companies, they are proof that security really can work at scale. The trick is to make it not cost Apple's resources to get remotely close to their security posture. (I hate to pick on Russians specifically, but they have no extradition treaty with the US. It's uncontroversial to point out that many black hat attempts originate from there.)
g051051 9y ago
> Just because you worked at a place with good security hygiene, it makes no difference to the world at large. Everybody else looks like Equifax. Equifax did have good security hygiene. But they didn't have perfect security hygiene, and this particular gap cost them big time. Most security incidents are like terror attacks that are averted. You read that authorities in Spain stopped an attack, and it means the system is working and people are safe. Then something explodes in London, and people are hurt, and you realize that there's no such thing as complete security.
- cmiles74 9y ago
  It remains to be seen how much this will cost Equifax, IMHO. Public opinion aside, it may not come down to much in termw of dollars and it's dollars that drive behavioral changes.

js2 9y ago

> Everybody else looks like Equifax. I don't doubt that there are other Equifaxes out there, nor do I doubt that there will be more leaks. But this wasn't a simple matter of a horrible code base. Heck, the leak wasn't even due to Equifax code, it was due to third party code. Other companies of Equifax's size apparently do better. Equifax should have done better, and I'll bet if the penalties for losing this data were more severe, would have done better.

sillysaurus3 9y ago
You can bet all you want. Your head will roll next, after Equifax and everyone else you decide to demonize. Once the avalanche starts, it won't stop. Know what happens when you demonize something? People stop reporting it. Look at the actual damage to actual people. You are arguing for prison time for the execs, if I remember correctly. Yet it's unclear that a single person has yet been materially damaged by these leaks. If you want to suck away N years of someone's life, you have a higher bar to clear.
- js2 9y ago
  (Meta: I think we edited our replies past each other.) I haven't commented on the Equifax incident, so you're confusing me for someone else. I don't have an opinion one way or the other on criminal negligence. How do we incentivize (or regulate?) companies to do a better job handling confidential data?
  - sillysaurus3 9y ago
    Ah, gotcha. Isn't it a bit scary seeing people argue for prison time for this? It's pretty easy to imagine webdevs becoming the actual targets / scapegoats rather than the execs. A note of "Well, let's not be too hasty" would seem to be in order. Part of the problem is that security breaches matter, but they don't matter. It's like the negative externality of factory pollution. One day perhaps the effects will become visible, but this disaster is about as bad as you can get and it's still not obvious that a lot of people are going to lose anything significant from the breach. If someone wanted to impersonate you, they can usually find a way already. Of course, if the 140M SSNs become public, that will change the situation completely. Possibly even for the better: then we'd finally stop relying on them to be secret when they were never designed to be. Believe it or not, the situation now is drastically better than it was a decade ago. People care about getting pentests now. You can grudgingly force a company to fork over the money. One of the best ways to get companies to become more secure is to force them. Most of the companies who were being pentested didn't want to be; they were forced to, because some other business refused to do business with them until they produced a document stating they were reasonably secure. This special document is only obtainable from a security firm; hence, pentests happen, and the world is marginally more secure.
    - deleted 9y ago
      [deleted]
    - jonmb 9y ago
      From what I've seen people want jail time because of the insider stock trading, not because of the security problem itself. So a webdev wouldn't be responsible unless they also engaged in insider trading.
sillysaurus3 9y ago
(replying to your "What if $40k for a pentest becomes a rubber stamp?" question, which was an important observation) Mm, it can become that. It's important to get a pentest from a reputable firm. At the one I worked at, it was a point of pride to come up with clever attacks. We'd make a sport of it and try to one-up each other. But it's easy to imagine some other pentest firm just going through the motions, running Nessus and calling it a day. Unfortunately, that's where money really does make a difference. $40k is at the low end of how absurdly expensive pentests are. Yet they make all the difference -- one app that I pentested was at a trading firm. I took that app from "typing ' leads to SQLi in their Node backend," and "there was SQLi in their Java backend if you were clever" to "you'd have to be more clever than me if you want to breach this app." Most attacks come from unsophisticated adversaries. This implies that raising the bar higher than these guys gets you 80% of the way home. The other 20% is much harder, but it's doable if your company has a culture of caring about security.
- js2 9y ago
  Thanks for replying and sorry for moving my comment.
  - sillysaurus3 9y ago
    It's all good. Just happy the world is starting to care about security.
yebyen 9y ago
> I think that more and more CISOs are becoming comfortable with the cloud and companies are insisting that CISOs become comfortable. So I always say that given enough time, we can secure anything and find a way to say yes to it and business-driven CISOs are of that mind. > If a CISO can come up with a list of controls that he/she is comfortable with, then by and large the evidence proves that those controls are working effectively and are going to satisfy the elements of any framework that you use. These are two soundbites from an interview with Susan Mauldin from over a year ago. Someone didn't want us to hear them, according to the timeline[1] of when someone remembered and reported that these interviews happened on September 9, and how soon after (on September 10) they were taken down (and then late last night, at least partially recovered again, further on down in this very HN thread!) They are not even especially damning soundbites if you put them out of context and honestly evaluate them in a vacuum, but it does put some additional context on "it was due to third party code" and in the context of this whole discussion, it is clear why someone did not want us to see this interview. If the job of the CISO is to deliver the project under budget and on time, rather than to do the job correctly as you and I understand it, then we are certainly more likely to find ourselves in this position. So let's keep having these discussions and make it better! It is absolutely your codebase and my codebase, we are all in this kind of trouble (or, we could be... if we all similarly had 140 million involuntary "customers" entrusting us with their SSNs and credit histories.) [1]: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic...
- karlkatzke 9y ago
  > If the job of the CISO is to deliver the project under budget and on time, rather than to do the job correctly as you and I understand it, then we are certainly more likely to find ourselves in this position The same fault is responsible for the Space Shuttle Columbia crash. It's called "leadership without vision." If you put a manager in place and give them tight constraints on how they deliver the product, they will almost universally deliver a critically flawed product ... albeit, on time and under budget.

deleted 9y ago

[deleted]

code_duck 9y ago

Why would all of the various criminal organizations across the world be deterred by something being illegal? The logic you have laid out makes it sound like only white hats would ever try to attack a credit agency. I'm pretty sure by the definition of black hat, and criminal organization, if these companies have something they want, and they have a technical means to get it, the fact that it's illegal is not a deterrent, it's actually their business model.

sillysaurus3 9y ago
The vast majority of adversaries are incompetent or unmotivated. It's why breaches don't happen daily. Look at it this way: If you get a pentest, you will immediately discover there were glaring security flaws that an attacker could have used to get into your network. This isn't true in every case, but for example I can count on one hand the number of companies I didn't get at least an XSS against. I had no magic. I'm just a guy using Burp suite, working together with someone else using Burp suite. When two talented people work together to break your stuff, they pull out rabbits that nobody knew existed. Especially when they've been doing it full time every day for a year. I'm sure black hats have talented people at their disposal. But they are selective. Launching a real operation against a US target is risky unless you live in Russia or work in China's army. And while it's valuable for Russian black hats to swipe Equifax's PII, other data troves typically aren't valuable enough to target. To put it another way, if Russians got into Facebook, so what? They'd get everyone's sultry private messages. Yet Facebook cares more about security than almost anyone else. That's why it's almost impossible to swipe their data. The vast majority of companies are in the "If Russians got in, it doesn't really matter; also we don't care" category. These are the mom and dad shops that use duct tape and glue for their payment processing. Above this are our companies: If Russians got in, it would be a minor disaster, but we care about preventing it. Except usually we don't care enough to put down $40k. Then you have companies like Equifax. The worst of both worlds: They weren't careful enough with their security, and it was an unprecedented disaster when someone got in. Yet even here, it's unclear how much this unprecedented disaster is going to materially harm people. Will those 140M SSNs show up on the black market for sale? Who will pay for them, and how much? (Hopefully it will be posted in full, in clear text, so we can all switch away from the stupid SSN system we've been relying on.) So when it's a combination of not too valuable to attack you, very costly to improve your defenses, and not too harmful if you screw up, you get the present world: ~everybody is vulnerable, but few companies care enough to pay more than lip service. Why would they? Even if they lost everyone's data tomorrow, it would be little more than egg on their face. This situation is changing, slowly. If the diff between 2008 and 2018 is like 2018 to 2028, we will be in excellent shape. But we have to avoid falling into traps like mandating regulation at every company, or sending people to prison. Those are tempting but misguided efforts: regulation would reduce the effectiveness of pentests, and sending people to prison will cause security breaches never to be reported. It will be hard, particularly when the world reacts like this: https://i.imgur.com/g01f9vV.png https://i.imgur.com/g01f9vV.png But companies like Apple are paving the way forward. Even if they help no other companies, they are proof that security really can work at scale. The trick is to make it not cost Apple's resources to get remotely close to their security posture. (I hate to pick on Russians specifically, but they have no extradition treaty with the US. It's uncontroversial to point out that many black hat attempts originate from there.)

g051051 9y ago

> Just because you worked at a place with good security hygiene, it makes no difference to the world at large. Everybody else looks like Equifax. Equifax did have good security hygiene. But they didn't have perfect security hygiene, and this particular gap cost them big time. Most security incidents are like terror attacks that are averted. You read that authorities in Spain stopped an attack, and it means the system is working and people are safe. Then something explodes in London, and people are hurt, and you realize that there's no such thing as complete security.

cmiles74 9y ago
It remains to be seen how much this will cost Equifax, IMHO. Public opinion aside, it may not come down to much in termw of dollars and it's dollars that drive behavioral changes.