5 ms·

It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here. EDIT/NO

by harryh 9y ago

It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here. EDIT/NOTE: https://news.ycombinator.com/item?id=16675493 https://news.ycombinator.com/item?id=16675493

Mc91 9y ago
> It's certainly true at financial institutions It's certainly not true at financial institutions. By financial institutions I mean Fortune 100 financial institutions, as well as smaller financial institutions. If by "pretty strict internal controls" you mean they can, like Prince Potemkin, point to such things existing in some chimeric form, then yes, I suppose you are right. But in any real sense, no, there are no effective controls in the real world. About 25 years ago I assumed it was early days for a lot of these things and they would sooner or later be closed up, but they haven't been. Things are wide open - as the recent Facebook/Analytics things have shown. In a very small and indirect way at that. The first major book on this broad subject was Donn Parker's "Crime by Computer" published in 1976. The book opens by saying that a company's biggest enemies in terms of computer crime is its own employees. This is still true 40+ years later - the biggest enemy of the people who own companies are the people who do the work at them.
mehrdadn 9y ago
> It was true at Google. Yes, because Google is not your average company. It takes security extremely seriously... in fact it's about as awful of an example as you can give for a blanket statement you made about "most companies".
- kerng 9y ago
  I'm not sure if Google even has an internal red team that performs breaches, last time I talked with someone there at a conference they didn't (that was 2016). So I am not sure Google has metrics on how easy it is to gain access by an adversary.
  - mehrdadn 9y ago
    > I'm not sure if Google even has an internal red team, last time I talked with someone there they didn't (was 18 months ago though). 2012: Google staffs up ‘Red Team’ And this was literally just a Google away: https://nakedsecurity.sophos.com/2012/08/24/google-red-team-privacy/ https://nakedsecurity.sophos.com/2012/08/24/google-red-team-...
    - kerng 9y ago
      Red team is an overloaded term: "Analyze software and services from a privacy perspective, ensuring they are in line with Google's stated privacy policies, practices, and the expectations of our users." Doesn't sound like adversary simulation to me.
      - kyrra 9y ago
        https://careers.google.com/jobs#!t=jo&jid=/google/security-engineering-manager-detection-google-building-c-747-6th-st-s-kirkland-3537510028 https://careers.google.com/jobs#!t=jo&jid=/google/security-e... The job even lists insider threat as part of their responsibility.
        kerng 9y ago
        Yeah, still not the same as actually performing breaches themselves to see how long it takes to compromise, and if they get detected and how long it takes to remediate and evict the adversary. I should have been a bit clearer with what I meant initially.
        sulam 9y ago
        How do you know there isn’t a team at Google doing this? It’s standard practice at companies of even middling size and Google is so large your friend might just be unaware of it.
        9y ago
- harryh 9y ago
  OK you're right that I overstated when I said "most companies." What I meant to say was most companies of the size and sophistication of Facebook that have a significant amount of private user information. Sorry for not being clear.
  - ajross 9y ago
    > What I meant to say was most companies of the size and sophistication of Facebook that have a significant amount of private user information. Which is to say... Google and Amazon?
  - tptacek 9y ago
    If you add "and notoriety" to that list of qualifiers, I agree with you!
    - harryh 9y ago
      I'm comfortable with such a qualification. Glad we can violently agree. ;-)
      - tptacek 9y ago
        That's a really short list of companies, though! There are a lot of companies that each independently hold a ghastly amount of information about random people that have virtually no meaningful controls over this stuff. "No meaningful controls" is the norm. I'd also say it's the norm among most Fortune 500 non-tech companies.
        RhodesianHunter 9y ago
        Yep. Equifax, Experian and Transunion come to mind.
        harryh 9y ago
        These are great counterpoints to the view I expressed and does make me reconsider my assumptions somewhat. Thanks!
- deleted 9y ago
  [deleted]
- collingreene 9y ago
  Internal abuse is a big area of effort for Facebook and google but things still go wrong. Here was googles moment for that back in 2010: https://www.wired.com/2010/09/google-spy/ https://www.wired.com/2010/09/google-spy/
- renaudg 9y ago
  > Google is not your average company. It takes security extremely seriously While this is certainly true, you've admitted elsewhere not knowing anything specifically about either Google or Facebook's security process, so how can you compare them ? You seem to just "know" Facebook doesn't take security seriously (which is of course a ludicrous thing to say)
  - mehrdadn 9y ago
    > While this is certainly true, you've admitted elsewhere not knowing anything specifically about either Google or Facebook's security process You already misquoted me once and I already replied to you. Why do you ignore it and do it again? Like I said: no, I never "admitted elsewhere not knowing anything specifically about either Google or Facebook's security process". You are misquoting me again just like you already did in [1], and it's quite improper that you choose to do this when I have already responded to you and called out your misrepresentation there. If you are looking for a response, see that post. If you are not, then please stop. [1] https://news.ycombinator.com/item?id=16676704 https://news.ycombinator.com/item?id=16676704
    - renaudg 9y ago
      I am most definitely not misrepresenting you. People like me or [1] have called you out because you keep contrasting Google and Facebook's internal security processes for no good reason, making definitive assertions like "[Google] takes security very seriously" [2], suggesting that Facebook doesn't and should do "Whatever Google does" [3]. And you're doing this not based on any specific knowledge of what the internal security process looks like at either company, but on your (flawed) perception of what engineering interns might or might not be able to do. When people like esman1 who actually have that knowledge and context, volunteer to explain to you [4] some of the safeguards in place (and he told you the truth), instead of taking the point, you won't have any of what he says and keep going at it stubbornly. I think this is the point where reasonable people stop arguing, and anyone else who cares can check your comments in this thread and make their own opinion. [1] https://news.ycombinator.com/item?id=16675843 https://news.ycombinator.com/item?id=16675843 [2] https://news.ycombinator.com/item?id=16675508 https://news.ycombinator.com/item?id=16675508 [3] https://news.ycombinator.com/item?id=16675707 https://news.ycombinator.com/item?id=16675707 [4] https://news.ycombinator.com/item?id=16675670 https://news.ycombinator.com/item?id=16675670
tptacek 9y ago
I believe it's true of Google! I do not believe it's true in general.
- harryh 9y ago
  shrug Without evidence we're both just guessing. Perhaps someone else will chime in with direct knowledge of how FB works.
  - mehrdadn 9y ago
    > shrug. Without evidence we're both just guessing. Do I understand correctly that you just admitted that your (extremely confident!) factual statement here: > most companies have pretty strict internal controls for this sort of thing was actually "just guessing"?
    - harryh 9y ago
      I'm guessing based on: 1) my direct knowledge of similar companies 2) the fact that no large scale leak from internal sources has happened from FB which is evidence that they have at least some internal controls or procedures to prevent one
  - bigiain 9y ago
    Evidence suggests it wasn't true at the NSA five or so years back... It's _probably_ true that things in general have gotten better since then, and it's probably true that they're better at _some_ companies like Google, Facebook, and Amazon - but I'd tend to agree that it's very unlikely to be true for "most companies".
    - sulam 9y ago
      The Snowden case is an interesting example. He went out of his way to get access to information, going so far as to transfer into a role that had more access (I don’t recall all the details but I remember that much). Every company has some category of employee whose job it is to ensure enforcement of policies, for instance, and if these people set out to subvert the system you should expect them to be able to do so. The watching watchers onion does eventually run out of skin (and it’s not even that deep most places).
uptown 9y ago
Unfortunately the internal tech infrastructures of many (not all) financial institutions are a mess of many decades of mergers and acquisitions resulting in a Rube Goldberg like backend of seemingly endless unnecessary complexity and dysfunction with, in many cases, superficial controls around who gets access to what.

by harryh 9y ago

Mc91 9y ago

> It's certainly true at financial institutions It's certainly not true at financial institutions. By financial institutions I mean Fortune 100 financial institutions, as well as smaller financial institutions. If by "pretty strict internal controls" you mean they can, like Prince Potemkin, point to such things existing in some chimeric form, then yes, I suppose you are right. But in any real sense, no, there are no effective controls in the real world. About 25 years ago I assumed it was early days for a lot of these things and they would sooner or later be closed up, but they haven't been. Things are wide open - as the recent Facebook/Analytics things have shown. In a very small and indirect way at that. The first major book on this broad subject was Donn Parker's "Crime by Computer" published in 1976. The book opens by saying that a company's biggest enemies in terms of computer crime is its own employees. This is still true 40+ years later - the biggest enemy of the people who own companies are the people who do the work at them.

mehrdadn 9y ago

> It was true at Google. Yes, because Google is not your average company. It takes security extremely seriously... in fact it's about as awful of an example as you can give for a blanket statement you made about "most companies".

kerng 9y ago
I'm not sure if Google even has an internal red team that performs breaches, last time I talked with someone there at a conference they didn't (that was 2016). So I am not sure Google has metrics on how easy it is to gain access by an adversary.
- mehrdadn 9y ago
  > I'm not sure if Google even has an internal red team, last time I talked with someone there they didn't (was 18 months ago though). 2012: Google staffs up ‘Red Team’ And this was literally just a Google away: https://nakedsecurity.sophos.com/2012/08/24/google-red-team-privacy/ https://nakedsecurity.sophos.com/2012/08/24/google-red-team-...
  - kerng 9y ago
    Red team is an overloaded term: "Analyze software and services from a privacy perspective, ensuring they are in line with Google's stated privacy policies, practices, and the expectations of our users." Doesn't sound like adversary simulation to me.
    - kyrra 9y ago
      https://careers.google.com/jobs#!t=jo&jid=/google/security-engineering-manager-detection-google-building-c-747-6th-st-s-kirkland-3537510028 https://careers.google.com/jobs#!t=jo&jid=/google/security-e... The job even lists insider threat as part of their responsibility.
      - kerng 9y ago
        Yeah, still not the same as actually performing breaches themselves to see how long it takes to compromise, and if they get detected and how long it takes to remediate and evict the adversary. I should have been a bit clearer with what I meant initially.
        sulam 9y ago
        How do you know there isn’t a team at Google doing this? It’s standard practice at companies of even middling size and Google is so large your friend might just be unaware of it.
        9y ago
harryh 9y ago
OK you're right that I overstated when I said "most companies." What I meant to say was most companies of the size and sophistication of Facebook that have a significant amount of private user information. Sorry for not being clear.
- ajross 9y ago
  > What I meant to say was most companies of the size and sophistication of Facebook that have a significant amount of private user information. Which is to say... Google and Amazon?
- tptacek 9y ago
  If you add "and notoriety" to that list of qualifiers, I agree with you!
  - harryh 9y ago
    I'm comfortable with such a qualification. Glad we can violently agree. ;-)
    - tptacek 9y ago
      That's a really short list of companies, though! There are a lot of companies that each independently hold a ghastly amount of information about random people that have virtually no meaningful controls over this stuff. "No meaningful controls" is the norm. I'd also say it's the norm among most Fortune 500 non-tech companies.
      - RhodesianHunter 9y ago
        Yep. Equifax, Experian and Transunion come to mind.
        harryh 9y ago
        These are great counterpoints to the view I expressed and does make me reconsider my assumptions somewhat. Thanks!
deleted 9y ago
[deleted]
collingreene 9y ago
Internal abuse is a big area of effort for Facebook and google but things still go wrong. Here was googles moment for that back in 2010: https://www.wired.com/2010/09/google-spy/ https://www.wired.com/2010/09/google-spy/
renaudg 9y ago
> Google is not your average company. It takes security extremely seriously While this is certainly true, you've admitted elsewhere not knowing anything specifically about either Google or Facebook's security process, so how can you compare them ? You seem to just "know" Facebook doesn't take security seriously (which is of course a ludicrous thing to say)
- mehrdadn 9y ago
  > While this is certainly true, you've admitted elsewhere not knowing anything specifically about either Google or Facebook's security process You already misquoted me once and I already replied to you. Why do you ignore it and do it again? Like I said: no, I never "admitted elsewhere not knowing anything specifically about either Google or Facebook's security process". You are misquoting me again just like you already did in [1], and it's quite improper that you choose to do this when I have already responded to you and called out your misrepresentation there. If you are looking for a response, see that post. If you are not, then please stop. [1] https://news.ycombinator.com/item?id=16676704 https://news.ycombinator.com/item?id=16676704
  - renaudg 9y ago
    I am most definitely not misrepresenting you. People like me or [1] have called you out because you keep contrasting Google and Facebook's internal security processes for no good reason, making definitive assertions like "[Google] takes security very seriously" [2], suggesting that Facebook doesn't and should do "Whatever Google does" [3]. And you're doing this not based on any specific knowledge of what the internal security process looks like at either company, but on your (flawed) perception of what engineering interns might or might not be able to do. When people like esman1 who actually have that knowledge and context, volunteer to explain to you [4] some of the safeguards in place (and he told you the truth), instead of taking the point, you won't have any of what he says and keep going at it stubbornly. I think this is the point where reasonable people stop arguing, and anyone else who cares can check your comments in this thread and make their own opinion. [1] https://news.ycombinator.com/item?id=16675843 https://news.ycombinator.com/item?id=16675843 [2] https://news.ycombinator.com/item?id=16675508 https://news.ycombinator.com/item?id=16675508 [3] https://news.ycombinator.com/item?id=16675707 https://news.ycombinator.com/item?id=16675707 [4] https://news.ycombinator.com/item?id=16675670 https://news.ycombinator.com/item?id=16675670

tptacek 9y ago

I believe it's true of Google! I do not believe it's true in general.

harryh 9y ago
shrug Without evidence we're both just guessing. Perhaps someone else will chime in with direct knowledge of how FB works.
- mehrdadn 9y ago
  > shrug. Without evidence we're both just guessing. Do I understand correctly that you just admitted that your (extremely confident!) factual statement here: > most companies have pretty strict internal controls for this sort of thing was actually "just guessing"?
  - harryh 9y ago
    I'm guessing based on: 1) my direct knowledge of similar companies 2) the fact that no large scale leak from internal sources has happened from FB which is evidence that they have at least some internal controls or procedures to prevent one
- bigiain 9y ago
  Evidence suggests it wasn't true at the NSA five or so years back... It's _probably_ true that things in general have gotten better since then, and it's probably true that they're better at _some_ companies like Google, Facebook, and Amazon - but I'd tend to agree that it's very unlikely to be true for "most companies".
  - sulam 9y ago
    The Snowden case is an interesting example. He went out of his way to get access to information, going so far as to transfer into a role that had more access (I don’t recall all the details but I remember that much). Every company has some category of employee whose job it is to ensure enforcement of policies, for instance, and if these people set out to subvert the system you should expect them to be able to do so. The watching watchers onion does eventually run out of skin (and it’s not even that deep most places).

uptown 9y ago

Unfortunately the internal tech infrastructures of many (not all) financial institutions are a mess of many decades of mergers and acquisitions resulting in a Rube Goldberg like backend of seemingly endless unnecessary complexity and dysfunction with, in many cases, superficial controls around who gets access to what.