5 ms·

This is an absurd appeal to the whole victim-blaming awareness trend. That's about an individual going about their life and having a crime perpetrated on them,

This is an absurd appeal to the whole victim-blaming awareness trend. That's about an individual going about their life and having a crime perpetrated on them, which primarily negatively affects them. This meanwhile is about a corporation entrusted with valuable information/access with the understanding the corporation would take appropriate measures to secure it. The victims here had an obligation to those they worked with to take reasonable measures to prevent and mitigate this sort of thing. Just because something bad happened to them doesn't relieve them of this obligation. It's possible for more than one party involved to be in the wrong. Just because the victims screwed up doesn't mean the perpetrator is somehow morally cleared. Nor does the perpetrator clear the victims of their carelessness. Edit: Since apparently people are taking this to mean I think companies should withstand a dedicated attack by China, I've gone wrong somewhere. I don't mean that. I was talking about responsibility. They can both be responsible and not be negligent. What I expect is them to help clean up afterwards. Just because they failed in an understandable way doesn't mean they get to avoid taking actions to ensure the damage is minimized.

dx87 8y ago
What should the companies have done to protect themselves against the state sponsored attack? The article doesn't say how they were compromised, so what "reasonable measures" didn't they take to mitigate being targeted by a powerful nation?
- excalibur 8y ago
  This is a fair point. Many of these large data breaches are revealed to be the result of negligence on the company's part (and often the company faces few to no consequences beyond public shaming). But in this particular case we simply don't have enough information yet to make that type of claim.
- dnbgfher 8y ago
  Sure, maybe this was something beyond what could be reasonably prevented by a non-state. I don't think we know yet. But they have a duty after the fact as well, to ensure the damage is minimized. That includes actually telling those potentially impacted what is known, etc.
  - ineedasername 8y ago
    This is true. It starts with China, it's their fault, but if your customers are compromised as a result they need know to protect themselves, or it spreads like a virus. IBM is not to blame for the initial attack. But any further attacks that result from their silence can have a good share of blame laid at their feet.
- A2017U1 8y ago
  Taken from another commenter: > according to the indictment, it was a few spearphishing emails with .docs attached, followed by keylogger and other malware installation. Junior Sysadmins straight out of a bootcamp can negate that.
umvi 8y ago
And I'm sure you believe Iran should've taken more reasonable measures to prevent Stuxnet? Securing yourself against script kiddies is one thing, but against a nation? Good luck.
- threeseed 8y ago
  Stuxnet involved multiple 0-day exploits which state sponsors can afford to buy and deploy against even low level companies if they see fit. Not sure how on earth people expect companies to defend against that.
  - nradov 8y ago
    Companies can defend against that through layered defense in depth and limiting the attack surface area.
    - threeseed 8y ago
      Well done. You've solved the security challenge of our generation. And all it took was meaningless buzzwords which almost all enterprise companies at least do already. It doesn't make one iota of difference when your vendor equipment or services are compromised.
    - ineedasername 8y ago
      Limit the attack surface all you want, there's still an attack surface, and state based actors are highly motivated to put extreme pressure on these. It's nearly axiomatic that there is no perfect security, and to expect a company to defend against all attacks from organizations whose cyber warfare budget exceeds the company's gross revenue is unreasonable.
  - nickpsecurity 8y ago
    Use secure devices, development practices, and so on. They've all existed since the 1980's on the market. IBM itself invented some of it in form of Fagan Inspections, VDM methodology, Cleanroom Software Engineering for low-defect development, a CPU that blocked leaks that violated a security policy, and a smartcard OS (Caernarvon) done by Karger et al to high-assurance standards. They could've afforded to use Ada, SPARK, and/or static analysis for protection by default from tons of 0-days. They had their own language, PL/S, with some protections. They instead of McAfee could've acquired Secure Computing Corporation or some other company if they wanted this expertise early plus some products with it. Boeings SNS server, which has no public hacks in 20-30 years, used the LOCK platform from SCC. There's small, new companies using lightweight, formal methods on kernels, protocols, and VPN's. One to four people groups in CompSci do the same thing regularly. IBM has even more developers. You mentioned Cisco in another comment. Why buy Cisco if their stuff is known to be insecure or not proven secure? If not knowing high-security, I'd consider genua just cuz they use OpenBSD at the core. There were two others using INTEGRITY RTOS, one Sentinel's HYDRA and another discontinued, with both having few buyers. There's still going to be attacks but way less of them choking attackers further year after year. Hell, even leaks in CPU's were found from 1992-1995 using these same methods as LOCK et al in VAX VMM. We knew then with companies and security folks just ignoring them because those high-performance, lower-cost CPU's let us do some awesome stuff, right? We're not getting hit because of ridiculous resources opponents put into 0-days: we're getting hit because of ridiculous resources put into known-insecure components and methods after people with those resources ignore stuff that works, often letting it die off. Totally, different problem. When phrased that way, one starts thinking maybe they should be regulated to use what works or liable for some of these decisions for ignoring what works using what's high-risk. I favor regulation after seeing positive results in TCSEC and DO-178B markets in terms of assurance activities.
threeseed 8y ago
As someone who has been involved in corporate security where we had a state sponsored attack your position is simply uninformed. Almost all companies simply do not have the capabilities to defend against state sponsored attacks and are already taking reasonable measures to prevent and mitigate. When you have undisclosed exploits being used against third party vendor hardware to attack the company what can you reasonably do ?
- dnbgfher 8y ago
  Mm. Perhaps I should have been a little more explicit. I never meant to imply any business should be able to handle a nation-state attack. That's not feasible. It doesn't mean they get to clean their hands of the whole thing either. They failed, and that's fine as long as they weren't being negligent. But they are still responsible for doing what they can to minimize the damage. That means, for one, informing those impacted about what is known. So, just to be super explicit. I don't expect a business to withstand a nation-state attack. I do however expect them to do what they can to minimize the damage afterwards.
- viraptor 8y ago
  There's possibility to decide what could be done by the company without saying they're completely responsible, or couldn't do anything. In this case it was spearphishing infected .docs. If corp security can't deal with that, they've got bigger problems.
- nradov 8y ago
  I don't believe you. Some companies may not have the capabilities to defend against state-sponsored attacks today, but that's only because their executives have chosen to be willfully ignorant and not devote sufficient resources to the problem. There's a whole industry of consultants and outsourcing services which provide exactly this capability. All you have to do is write a check.
  - Terr_ 8y ago
    > All you have to do is write a check. "I don't believe you." You can't just change the organization, culture, and procedures of a company just by throwing money at consultants. That's like saying a big family can solve their feuds and mental illnesses just by writing a check to team of group therapists and lawyers.
Kalium 8y ago
You're completely right. Every company has a basic, fundamental obligation to respect the human rights of their customers and partners to security and privacy. This is best manifested as taking reasonable measures to ensure that this basic human right is protected. Now, there may be a wrinkle. When discussing nation-state grade actors, there's a very real possibility that they may attack in ways that cannot reasonably have been protected against by most private-sector security programs. What are we to think, to do, to expect in such a scenario? To what extent should be expect any company, even a large and wealthy one, to successfully fend off the full might of a large and powerful nation-state's offensive information security apparatus? Again, you're absolutely and unquestionably right. Companies can, should, and must take reasonable measures to protect the basic human rights of security and privacy. There just might be some room for subtlety when considering what reasonable measures can accomplish.
- dnbgfher 8y ago
  Absolutely. I didn't mean to imply otherwise. I don't expect companies to be able to stand up to dedicated attention from a nation-state. What I was trying to say was that that doesn't relieve them of their responsibilities to minimize the damage afterwards. Just because they can't be expected to win doesn't mean they should be able to wash their hands of the whole affair without trying to help.
  - Kalium 8y ago
    What do you expect the outcome would be in a scenario where a company is living up their responsibilities to deploy reasonable measures, deploy defense in depth, and work to minimize the damage of a breach in the face of a sustained nation-state attack? More to the point, in what ways are the companies allegedly breached failing to live up to their responsibilities to help minimize the damage of a breach? What should they do in a scenario where investigations may be ongoing and potentially involving law enforcement?

dx87 8y ago

What should the companies have done to protect themselves against the state sponsored attack? The article doesn't say how they were compromised, so what "reasonable measures" didn't they take to mitigate being targeted by a powerful nation?

excalibur 8y ago
This is a fair point. Many of these large data breaches are revealed to be the result of negligence on the company's part (and often the company faces few to no consequences beyond public shaming). But in this particular case we simply don't have enough information yet to make that type of claim.
dnbgfher 8y ago
Sure, maybe this was something beyond what could be reasonably prevented by a non-state. I don't think we know yet. But they have a duty after the fact as well, to ensure the damage is minimized. That includes actually telling those potentially impacted what is known, etc.
- ineedasername 8y ago
  This is true. It starts with China, it's their fault, but if your customers are compromised as a result they need know to protect themselves, or it spreads like a virus. IBM is not to blame for the initial attack. But any further attacks that result from their silence can have a good share of blame laid at their feet.
A2017U1 8y ago
Taken from another commenter: > according to the indictment, it was a few spearphishing emails with .docs attached, followed by keylogger and other malware installation. Junior Sysadmins straight out of a bootcamp can negate that.

umvi 8y ago

And I'm sure you believe Iran should've taken more reasonable measures to prevent Stuxnet? Securing yourself against script kiddies is one thing, but against a nation? Good luck.

threeseed 8y ago
Stuxnet involved multiple 0-day exploits which state sponsors can afford to buy and deploy against even low level companies if they see fit. Not sure how on earth people expect companies to defend against that.
- nradov 8y ago
  Companies can defend against that through layered defense in depth and limiting the attack surface area.
  - threeseed 8y ago
    Well done. You've solved the security challenge of our generation. And all it took was meaningless buzzwords which almost all enterprise companies at least do already. It doesn't make one iota of difference when your vendor equipment or services are compromised.
  - ineedasername 8y ago
    Limit the attack surface all you want, there's still an attack surface, and state based actors are highly motivated to put extreme pressure on these. It's nearly axiomatic that there is no perfect security, and to expect a company to defend against all attacks from organizations whose cyber warfare budget exceeds the company's gross revenue is unreasonable.
- nickpsecurity 8y ago
  Use secure devices, development practices, and so on. They've all existed since the 1980's on the market. IBM itself invented some of it in form of Fagan Inspections, VDM methodology, Cleanroom Software Engineering for low-defect development, a CPU that blocked leaks that violated a security policy, and a smartcard OS (Caernarvon) done by Karger et al to high-assurance standards. They could've afforded to use Ada, SPARK, and/or static analysis for protection by default from tons of 0-days. They had their own language, PL/S, with some protections. They instead of McAfee could've acquired Secure Computing Corporation or some other company if they wanted this expertise early plus some products with it. Boeings SNS server, which has no public hacks in 20-30 years, used the LOCK platform from SCC. There's small, new companies using lightweight, formal methods on kernels, protocols, and VPN's. One to four people groups in CompSci do the same thing regularly. IBM has even more developers. You mentioned Cisco in another comment. Why buy Cisco if their stuff is known to be insecure or not proven secure? If not knowing high-security, I'd consider genua just cuz they use OpenBSD at the core. There were two others using INTEGRITY RTOS, one Sentinel's HYDRA and another discontinued, with both having few buyers. There's still going to be attacks but way less of them choking attackers further year after year. Hell, even leaks in CPU's were found from 1992-1995 using these same methods as LOCK et al in VAX VMM. We knew then with companies and security folks just ignoring them because those high-performance, lower-cost CPU's let us do some awesome stuff, right? We're not getting hit because of ridiculous resources opponents put into 0-days: we're getting hit because of ridiculous resources put into known-insecure components and methods after people with those resources ignore stuff that works, often letting it die off. Totally, different problem. When phrased that way, one starts thinking maybe they should be regulated to use what works or liable for some of these decisions for ignoring what works using what's high-risk. I favor regulation after seeing positive results in TCSEC and DO-178B markets in terms of assurance activities.

threeseed 8y ago

As someone who has been involved in corporate security where we had a state sponsored attack your position is simply uninformed. Almost all companies simply do not have the capabilities to defend against state sponsored attacks and are already taking reasonable measures to prevent and mitigate. When you have undisclosed exploits being used against third party vendor hardware to attack the company what can you reasonably do ?

dnbgfher 8y ago
Mm. Perhaps I should have been a little more explicit. I never meant to imply any business should be able to handle a nation-state attack. That's not feasible. It doesn't mean they get to clean their hands of the whole thing either. They failed, and that's fine as long as they weren't being negligent. But they are still responsible for doing what they can to minimize the damage. That means, for one, informing those impacted about what is known. So, just to be super explicit. I don't expect a business to withstand a nation-state attack. I do however expect them to do what they can to minimize the damage afterwards.
viraptor 8y ago
There's possibility to decide what could be done by the company without saying they're completely responsible, or couldn't do anything. In this case it was spearphishing infected .docs. If corp security can't deal with that, they've got bigger problems.
nradov 8y ago
I don't believe you. Some companies may not have the capabilities to defend against state-sponsored attacks today, but that's only because their executives have chosen to be willfully ignorant and not devote sufficient resources to the problem. There's a whole industry of consultants and outsourcing services which provide exactly this capability. All you have to do is write a check.
- Terr_ 8y ago
  > All you have to do is write a check. "I don't believe you." You can't just change the organization, culture, and procedures of a company just by throwing money at consultants. That's like saying a big family can solve their feuds and mental illnesses just by writing a check to team of group therapists and lawyers.

Kalium 8y ago

You're completely right. Every company has a basic, fundamental obligation to respect the human rights of their customers and partners to security and privacy. This is best manifested as taking reasonable measures to ensure that this basic human right is protected. Now, there may be a wrinkle. When discussing nation-state grade actors, there's a very real possibility that they may attack in ways that cannot reasonably have been protected against by most private-sector security programs. What are we to think, to do, to expect in such a scenario? To what extent should be expect any company, even a large and wealthy one, to successfully fend off the full might of a large and powerful nation-state's offensive information security apparatus? Again, you're absolutely and unquestionably right. Companies can, should, and must take reasonable measures to protect the basic human rights of security and privacy. There just might be some room for subtlety when considering what reasonable measures can accomplish.

dnbgfher 8y ago
Absolutely. I didn't mean to imply otherwise. I don't expect companies to be able to stand up to dedicated attention from a nation-state. What I was trying to say was that that doesn't relieve them of their responsibilities to minimize the damage afterwards. Just because they can't be expected to win doesn't mean they should be able to wash their hands of the whole affair without trying to help.
- Kalium 8y ago
  What do you expect the outcome would be in a scenario where a company is living up their responsibilities to deploy reasonable measures, deploy defense in depth, and work to minimize the damage of a breach in the face of a sustained nation-state attack? More to the point, in what ways are the companies allegedly breached failing to live up to their responsibilities to help minimize the damage of a breach? What should they do in a scenario where investigations may be ongoing and potentially involving law enforcement?