4 ms·

If you have anything of value, I absolutely guarantee you that there are hackers in your network right now. One thing that frustrates me more than anything els

If you have anything of value, I absolutely guarantee you that there are hackers in your network right now. One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.

Spooky23 8y ago
That phenomenon is worse in environments with lots of compliance, as the security people tend to think like auditors instead of security professionals.
viraptor 8y ago
That's a really defeatist attitude. There are different levels of "value" and different levels of protection. Not everything is internet facing. Not everything is managed like a corp where turnover requires lots of access changes. Not everything allows you persistence in the network. And not all access is "access". I really wish we moved past the "everybody's owned" idea. Your defence should be proportional to the value you can lose. You can monitor for the rest. And you can't guarantee the are hackers in my network. (Unless you're saying you're guilty of breaking in? ;-) )
- hibikir 8y ago
  I don’t think the grandparent says that everyone is owned, but that if your data is interesting enough, your threat model must include employees that are willingly exhilarating data, sometimes for nation states. That your first barriers are therefore assumed to be breached to those attackers. This of course does not apply if you are not holding on to anything interesting, but it’s very easy to become interesting at a certain size, or if you have interesting customers. Still, not everybody.
  - viraptor 8y ago
    My response was triggered by "If you have anything of value". I agree with "if your data is interesting enough". Because let's be honest, barely any company qualifies for nation state embedding a worker with them. If they do, they know. But everybody has something of value.
  - mandevil 8y ago
    Your threat exposure is not just your network. It's all of your customers and all of your vendors as well. Recall that the Target POS hack back in 2014 happened because someone hacked the largest refrigeration contractor in western Pennsylvania, then bounced from there onto the Target Partners Online portal with legitimate credentials, and then from there in unspecified ways got onto the POS system. Obviously going from TPO to POS is a failure of Target's network security, but their network perimeter was much larger than just Target computers.
- closeparen 8y ago
  It’s defeatist if you’re committed to a network-perimeter security model. If your internal services are built to public-facing standards it’s a shrug.
andyv 8y ago
... and if you don't have anything of value, they came, looked and left.

Spooky23 8y ago

That phenomenon is worse in environments with lots of compliance, as the security people tend to think like auditors instead of security professionals.

viraptor 8y ago

That's a really defeatist attitude. There are different levels of "value" and different levels of protection. Not everything is internet facing. Not everything is managed like a corp where turnover requires lots of access changes. Not everything allows you persistence in the network. And not all access is "access". I really wish we moved past the "everybody's owned" idea. Your defence should be proportional to the value you can lose. You can monitor for the rest. And you can't guarantee the are hackers in my network. (Unless you're saying you're guilty of breaking in? ;-) )

hibikir 8y ago
I don’t think the grandparent says that everyone is owned, but that if your data is interesting enough, your threat model must include employees that are willingly exhilarating data, sometimes for nation states. That your first barriers are therefore assumed to be breached to those attackers. This of course does not apply if you are not holding on to anything interesting, but it’s very easy to become interesting at a certain size, or if you have interesting customers. Still, not everybody.
- viraptor 8y ago
  My response was triggered by "If you have anything of value". I agree with "if your data is interesting enough". Because let's be honest, barely any company qualifies for nation state embedding a worker with them. If they do, they know. But everybody has something of value.
- mandevil 8y ago
  Your threat exposure is not just your network. It's all of your customers and all of your vendors as well. Recall that the Target POS hack back in 2014 happened because someone hacked the largest refrigeration contractor in western Pennsylvania, then bounced from there onto the Target Partners Online portal with legitimate credentials, and then from there in unspecified ways got onto the POS system. Obviously going from TPO to POS is a failure of Target's network security, but their network perimeter was much larger than just Target computers.
closeparen 8y ago
It’s defeatist if you’re committed to a network-perimeter security model. If your internal services are built to public-facing standards it’s a shrug.

andyv 8y ago

... and if you don't have anything of value, they came, looked and left.