10 ms·

U.S. Cities Strain to Fight Hackers

128 points by Bostonian 7y ago

microcolonel 7y ago
Don't put extremely sensitive information on the internet.
- njyx 7y ago
  On the other hand, we want digital public services, to be able to pay taxes electronically, to be able to vote electronically etc. I don't think the "don't put sensitive information on the Internet" idea really holds any water unless we expect our public services to be done with pen and paper for evermore, while everything else goes digital. (Yes, machines could be disconnected from the network and so on... but that's arguably just saying "an airgap is all you need")
  - testvox 7y ago
    But those things can be done without putting sensitive information on the internet. Crypto currency transactions can keep everything sensitive off the network. A one way airgap is indeed all you need (your device should be able to push data to the network but never receive any data from the network). The same scheme works for voting.
    - kryogen1c 7y ago
      > A one way airgap is indeed all you need This is an oxymoron. If something can communicate, even only in 1 direction, its not airgapped. Furthermore, theres no such thing as 1-way communication. Any DB that houses info can only provide it in response to a query.
      - packet_nerd 7y ago
        > theres no such thing as 1-way communication It's called a data diode. https://www.opswat.com/blog/why-data-diodes-are-essential-isolated-and-classified-networks https://www.opswat.com/blog/why-data-diodes-are-essential-is... https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
  - mtgx 7y ago
    > to be able to vote electronically That's one thing we definitely shouldn't want. This case is just the latest proving what a bad idea that is.
    - RosanaAnaDana 7y ago
      I want to be able to vote electronically.
      - craftyguy 7y ago
        Then you don't understand why it is a terrible idea.
        selebrazin 7y ago
        Instead of such general and frankly unhelpful statements, would you mind explaining to the previous poster why electronic voting is such a bad idea? It may even generate further discussion instead of just downvotes.
  - microcolonel 7y ago
    Well, I would prefer it, but at least at the scale of towns and small cities, I simply don't trust them. Furthermore, if they do so many things that they need a public-facing website to manage all of the sensitive information they keep on me, I probably don't want to live there. It's all well and good wanting to access a municipal government's private records through the internet, but try to think of how likely they are to get that right, and adjust your desires accordingly.
  - darkpuma 7y ago
    > "we want [...] to be able to vote electronically etc." Speak for yourself. I see no upsides.
    - gabriel-uribe 7y ago
      Wouldn't increasing voter turnout be an upside? Reducing the loss of productivity of those participating? Voting electronically is dangerous today, but I still see it as something to work towards. However, I imagine that would require incredible innovation towards multiple layers of robust identity verification protocols.
      - darkpuma 7y ago
        > "Wouldn't increasing voter turnout be an upside?" There are better, less drastic, ways of making voting more accessible. Washington state's system of mailing everybody a ballot works pretty well. I usually don't even remember when elections are coming up until I get a ballot in the mail, without ever asking for it. In Washington, people who care to vote don't have any trouble finding the time. (Of course many people just don't give a shit, and electronic voting won't change that.)
- dandersh 7y ago
  Unfortunately this information was expected to be divulged and collected before the internet was widely used. Policies and infrastructures were not put in place (or ignored, as I've personally witnessed) to protect this information once it was digitized. At the same time, there should be a real discussion over why so much information is being demanded, why SSN's are being overused as they are, etc.
- pixelrevision 7y ago
  This is more of a "don't let various government agencies neglect their infrastructure while hosting extremely sensitive information about you" sort of situation. Really the bigger concern is that a ton of infrastructure is at risk of getting held hostage.
  - microcolonel 7y ago
    Stop building the infrastructure, it is worse than nothing. They clearly don't have any interest in taking responsibility for securing these systems, which is why the friendly headline is "U.S. Cities Strain to Fight Hackers" and not "U.S. Cities divulge sensitive information to criminals through a pattern of routine incompetence.".
- Bakary 7y ago
  This is like abstinence for STD prevention. Simultaneously true and irrelevant to the problem at hand.
newswriter99 7y ago
AP style should really push journalists to use the term "cybercriminals" over "hackers". I'm not the first to say it but the issue is growing, and it's only going to make the public more leery of any tech-minded but innocent kid or professional pentesting adult who uses the term "hacker".
- surge 7y ago
  Journalists aren't that bright, they get confused at the difference.
  - duxup 7y ago
    Even in tech circles the terminology is pretty mixed usage wise.
  - stochastic_monk 7y ago
    Some are brilliant (e.g., Ronan Farrow), but the real point is that they’re speaking to an audience which they’re essentially trying to coddle because the audience isn’t comprised of experts.
    - newswriter99 7y ago
      You're on to something but it's a tiny bit more complicated than that. Take general assignment reporters for example. They have to learn how to learn. What I mean is, they're experts on digesting new information. Because they have to write about ANYTHING at a moment's notice, and can't be expected to be experts on everything. THEN they have to write about that topic using only 500 words (or so) to an audience who also probably knows nothing about the topic. That's a tall order and you shouldn't be surprised reporters get it wrong sometimes.
  - newswriter99 7y ago
    Probably worth noting I've been in journalism going on a decade now. It's a bit too easy to simply write off ALL journalists (no pun intended) as "not that bright". You may as well say most people aren't that bright. Which would be equally unfair. Likewise, how can you stick a small-town reporter who covers highschool basketball in the same list as a New York Times reporter with an Ivy League background in economics? Make no mistake, I'm not implying the latter is somehow superior to the former, but there is a huge range between the people who make up the journalism industry.
joeyrideout 7y ago
I've been wondering lately, would it be at all feasible for a "ransom bounty" program to exist? A platform similar to HackerOne except to act as a middleman between companies (with specific rules of engagement) and attackers who can plant "friendly" non-damaging ransomware (or the real thing on a designated target box) in exchange for a bounty and report of vulnerabilities. The major caveat would be the general limitation of most bounty programs against social engineering and phishing...
DyslexicAtheist 7y ago
any non paywalled links?
oldjokes 7y ago
Replace "cities" with "any organization that is not tech first" and you'll still find hundreds of win 7/vista/xp machines that have never been patched, and ad-hoc network closet/cloud hybrid rigged solutions for everything. There is literally no way to fix all this dumb fragile infrastructure without a massive government program that accepts responsibility for doing so. You need thousands of smart people going through every machine, all the software, all the systems. These people are never going to work for Baltimore or for Maersk, not in a million years. Instead let's create a new government agency or pivot the NSA from it's dumb paranoid reactionary posture to more of a proactive NIST-style advisory role on best practices, have them hack everything domestically and start fixing things as their core mission. Make sure nobody at state or DHS or justice can subvert this new agency, they need to stand on equal footing with any company or agency. Then hopefully pillage all the miserable smart people who are currently working at mega corps and agencies who actually want to do positive, meaningful work for a change. Problem solved someone hire me to advise on their political campaign.
- qaq 7y ago
  "any organization that is not tech first" - thats pretty optimistic looking at a number of the tech first companies that have being breached.
  - peterwwillis 7y ago
    I don't know why you got downvoted. I know plenty of companies with modern tech that absolutely suck at security. Security is just hard, and it's not easier just because you're a tech company. By comparison, if you spend billions of dollars on a modern building, I can still probably break into it with just a can of compressed air. I doubt the design plans for the building included "mitigate compressed air attacks", and it's the same with every other kind of organization.
    - throw0101a 7y ago
      > Security is just hard, and it's not easier just because you're a tech company. We're not talking about everyone having Red Teams here. We're talking about keeping up to date with regards to Patch Tuesday, or even just having an OS that still actually gets patches. That'll get us 80-90% of the way to decent security: > “Almost two months passed between the release of fixes for the EternalBlue vulnerability and when ransomware attacks began,” Microsoft warned. “Despite having nearly 60 days to patch their systems, many customers had not. A significant number of these customers were infected by the ransomware.” * https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/ https://krebsonsecurity.com/2019/06/report-no-eternal-blue-e...
javagram 7y ago
These type of organizations probably need to be running all chromebooks with a G Suite enterprise account (configured to require all employees to use 2FA). Something that has way less attack surface than what they have now.
- bytematic 7y ago
  Imagine getting/teaching them to use G Suite accounts, something I've attempted once. I thought it would be the easiest possible transition
Kurtz79 7y ago
Could someone suggest recognized and useful certifications, for those interesting getting into cybersecurity? The article has a link to another mentioning CompTIA and CISSP, are they any good?
- dsr_ 7y ago
  CISSP is good for getting hired. I'm not sure it proves much about your skills, so much as your vocabulary.
- neuralzen 7y ago
  CompTIA certs are a mixed bag, some are decent, but many are very surface level. CISSP is broad, and more managerial level, but certainly worthwhile. But if you'd like some in the trenches stuff, I'd suggest the OSCP.
- driverdan 7y ago
  Study to learn skills, not to get certs.
  - Kurtz79 7y ago
    Any suggestion on good study material, then? A lot of resources seems to be more like games than something applicable to the real world.
true_tuna 7y ago
Stop posting WSJ paywall articles. This isn’t a paywall advertisement service.
- dang 7y ago
  If there's a workaround, it's ok. Users usually post workarounds in the thread. This is in the FAQ at https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html and there's more explanation here: https://news.ycombinator.com/item?id=10178989 https://news.ycombinator.com/item?id=10178989 https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix&page=0&query=by:dang%20paywall https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
  - craftyguy 7y ago
    If there's a workaround and it's not hard for people to find it and paste it into the comments, then it's not hard for people submitting articles to post the non-paywall version in the first place.
    - dang 7y ago
      It's important that the original URL be used so that readers can see what the domain is. It's for that same reason that HN doesn't allow link shorteners.
neonate 7y ago
http://archive.is/AXk1l http://archive.is/AXk1l
parliament32 7y ago
Paywalled, non-paywall link: https://www.wsj.com/articles/u-s-cities-strain-to-fight-hackers-11559899800?mod=rsswn https://www.wsj.com/articles/u-s-cities-strain-to-fight-hack... https://archive.fo/AXk1l https://archive.fo/AXk1l
bluedino 7y ago
I'm painting with a broad brush here, but a lot of government employees do as little as possible. They are union protected, so they can stay in their jobs for a very long time. So you get a lot of the thing in IT where someone has 20 years of 1 year experience. I'm sure the budgets aren't great and the rest of the government isn't pushing tech, but you end up with a lot of 'it works fine just leave it as is'
- moosey 7y ago
  > I'm painting with a broad brush here, but a lot of government employees do as little as possible. Welcome to humanity. How many people actually devote their lives to the improvement of the human condition, or have a devotion to even the jobs that they are working for? I fear that treating your job with the devotion necessary to do it truly effectively means that you limit yourself and future opportunities, because you must devote time to your own growth. And how many people are interested in devotion to any cause or personal growth? Personal growth is hard, and devotion to a cause, a serious one especially, is equally painful. Understanding climate change, for instance, is so painful that people reject it in its entirety; it could be because it is a direct refutation to their world view, or because the idea is just so uncomfortable on its face. I feel as if Ada Palmer had it right when she suggests that the first rule of Utopians must be "I hereby renounce the right to complacency, and vow lifelong to take only what minimum of leisure is necessary to my productivity, viewing health, happiness, rest, and play as means, not ends". I think that's too much weight for the vast majority of humanity, and understandably so. In America it feels as if the way society is structured is designed to sap willpower (for example: the Atomic Family). I can think of a number of reasons why this might actually be the planned outcome of its current design.
nwalker85 7y ago
There is a big industry starting to spring up around this, data insurance. Go to any big insurance conference and all they are talking about right now is cyber insurance. Construction companies are asking for it for example; they've always had to insure their employees, but now they are seeing things like their offices being hit by cryptolockers and being extorted for bitcoin by Russians. They can't afford to lose productivity over something like that so they are getting insured. Those insurance agencies are working with security consultants to help harden the networks too. So yes, this is definitely a big problem, but the wheels are already moving to start addressing this issue, because there is money to be made.
- thephyber 7y ago
  It's not clear how valuable cybersecurity insurance will be if there is no coverage for "acts of war" or if the insurer claims the insured didn't do enough to protect/defend against it. [1] [1] https://www.lawfareblog.com/moment-truth-cyber-insurance https://www.lawfareblog.com/moment-truth-cyber-insurance
4ntonius8lock 7y ago
I'm surprised no one has mentioned it here on hacker news. But when CFAA makes all hacking criminal, the only hackers left are criminals. Ethically motivated hackers should have the same protections as whistle blowers - The day that happens, the world becomes more safe and transparent. But transparency is not what everyone wants, obviously. I wish I was more surprised that mainstream media fails to mention this important part of the state of cyber security in the US.
- AgentME 7y ago
  In the process of using a town's court website to try to pay a parking ticket, I practically-accidentally found a security vulnerability in it. The vulnerability immediately showed me many people's personal information. I closed the page when I realized what had happened. I didn't report the issue because I was worried that the people running a small town's buggy court website might be more interested in figuring out what laws I broke than understanding the issue. I'd rather have nothing to do with it. It's the only time I haven't reported a security vulnerability I've found. I'm probably over-thinking it, but when there's other groups that invite vulnerability reports and even give bug bounties, it just feels like an unnecessary risk reaching out to ones that don't.
  - 4ntonius8lock 7y ago
    Over thinking it? I don't think so. 35 years of jail time has a powerful chilling effect. How this article could talk about the 'surprising' lack of ethical hackers without covering this law and it's abuse is beyond me. It's like talking about the 'surprising lack of research into clinical MDMA studies' and not talk about the war on drugs. It's like they are intentionally ignoring the HUGE elephant in the room.
elipsey 7y ago
How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process. Also, in my experience working for state government, engineers were considered a waste of money. Hiring was difficult because they wouldn't pay anywhere close to the market rate, and techies weren't allowed to earn more then managers. There was a parade of sales people pitching the director to lay off the devs and outsource everything, and then pat each other on the back for "slashing government waste." It seems like most of their apps should in principal should not need to have been completely reinvented from scratch, but having people who don't work here responsible for security causes an agent-principle problem; from the point of view of the contractors who don't care about your security and the bureaucrats who don't understand it, everything except management is just a cost center. If you do manage to fix anything, the new director will throw it away and start over with a new vendor contract next election. Also, if you are paid by the gvt and are not a cop or a politician, you will be despised as a "useless feeder" and face the risk or furlough, de-funding, re-org, hiring freezes, etc, that make it hard to reliably get anything done. If the public doesn't want a public sector, why fight them by trying to work there? I think Schneier was right to point out that security is an economic externality, and that a high level political solution is likely necessary. https://www.schneier.com/essays/archives/2007/01/information_security_1.html https://www.schneier.com/essays/archives/2007/01/information... EDIT: A couple of people here have pointed out that a "cyber" insurance industry is emerging. I find this encouraging because it at least seems possible for that to be a politically acceptable mechanism for pricing security; your premiums could be contingent on compliance as determined by the insurer, who has skin in the game to understand security and hire real professionals as auditors. I'm not sure how that translates to actually fixing security, but it seems like a start.
- meesles 7y ago
  100% agreed. I've always found it very ironic that governments want the best and brightest when they never pay market rates. Not only do they want the best and brightest, they want them to selflessly serve their country at the cost of financial advancement. Is it surprising that they end up getting the lower end of the crop? https://18f.gsa.gov/ https://18f.gsa.gov/ was a fantastic move and exactly what we need. Unfortunately, it took a group of extremely successful private sector individuals to give up their careers temporarily in pursuit of fixing something.
wehack 7y ago
Do you need hackers for hire? Do you need to keep an eye on your spouse by gaining access to their emails? As a parent do you want to know what your kids do on a daily basis on all social networks in others to make sure they're not getting into trouble? Whatever it is, Ranging from Bank Jobs, Flipping cash, Criminal records, removal of mugshots ,DMV, Taxes, crypto currency fraud investigation Name it, they can get the job done www dot assured hacks dot com

128 points by Bostonian 7y ago

microcolonel 7y ago

Don't put extremely sensitive information on the internet.

njyx 7y ago
On the other hand, we want digital public services, to be able to pay taxes electronically, to be able to vote electronically etc. I don't think the "don't put sensitive information on the Internet" idea really holds any water unless we expect our public services to be done with pen and paper for evermore, while everything else goes digital. (Yes, machines could be disconnected from the network and so on... but that's arguably just saying "an airgap is all you need")
- testvox 7y ago
  But those things can be done without putting sensitive information on the internet. Crypto currency transactions can keep everything sensitive off the network. A one way airgap is indeed all you need (your device should be able to push data to the network but never receive any data from the network). The same scheme works for voting.
  - kryogen1c 7y ago
    > A one way airgap is indeed all you need This is an oxymoron. If something can communicate, even only in 1 direction, its not airgapped. Furthermore, theres no such thing as 1-way communication. Any DB that houses info can only provide it in response to a query.
    - packet_nerd 7y ago
      > theres no such thing as 1-way communication It's called a data diode. https://www.opswat.com/blog/why-data-diodes-are-essential-isolated-and-classified-networks https://www.opswat.com/blog/why-data-diodes-are-essential-is... https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
- mtgx 7y ago
  > to be able to vote electronically That's one thing we definitely shouldn't want. This case is just the latest proving what a bad idea that is.
  - RosanaAnaDana 7y ago
    I want to be able to vote electronically.
    - craftyguy 7y ago
      Then you don't understand why it is a terrible idea.
      - selebrazin 7y ago
        Instead of such general and frankly unhelpful statements, would you mind explaining to the previous poster why electronic voting is such a bad idea? It may even generate further discussion instead of just downvotes.
- microcolonel 7y ago
  Well, I would prefer it, but at least at the scale of towns and small cities, I simply don't trust them. Furthermore, if they do so many things that they need a public-facing website to manage all of the sensitive information they keep on me, I probably don't want to live there. It's all well and good wanting to access a municipal government's private records through the internet, but try to think of how likely they are to get that right, and adjust your desires accordingly.
- darkpuma 7y ago
  > "we want [...] to be able to vote electronically etc." Speak for yourself. I see no upsides.
  - gabriel-uribe 7y ago
    Wouldn't increasing voter turnout be an upside? Reducing the loss of productivity of those participating? Voting electronically is dangerous today, but I still see it as something to work towards. However, I imagine that would require incredible innovation towards multiple layers of robust identity verification protocols.
    - darkpuma 7y ago
      > "Wouldn't increasing voter turnout be an upside?" There are better, less drastic, ways of making voting more accessible. Washington state's system of mailing everybody a ballot works pretty well. I usually don't even remember when elections are coming up until I get a ballot in the mail, without ever asking for it. In Washington, people who care to vote don't have any trouble finding the time. (Of course many people just don't give a shit, and electronic voting won't change that.)
dandersh 7y ago
Unfortunately this information was expected to be divulged and collected before the internet was widely used. Policies and infrastructures were not put in place (or ignored, as I've personally witnessed) to protect this information once it was digitized. At the same time, there should be a real discussion over why so much information is being demanded, why SSN's are being overused as they are, etc.
pixelrevision 7y ago
This is more of a "don't let various government agencies neglect their infrastructure while hosting extremely sensitive information about you" sort of situation. Really the bigger concern is that a ton of infrastructure is at risk of getting held hostage.
- microcolonel 7y ago
  Stop building the infrastructure, it is worse than nothing. They clearly don't have any interest in taking responsibility for securing these systems, which is why the friendly headline is "U.S. Cities Strain to Fight Hackers" and not "U.S. Cities divulge sensitive information to criminals through a pattern of routine incompetence.".
Bakary 7y ago
This is like abstinence for STD prevention. Simultaneously true and irrelevant to the problem at hand.

newswriter99 7y ago

AP style should really push journalists to use the term "cybercriminals" over "hackers". I'm not the first to say it but the issue is growing, and it's only going to make the public more leery of any tech-minded but innocent kid or professional pentesting adult who uses the term "hacker".

surge 7y ago
Journalists aren't that bright, they get confused at the difference.
- duxup 7y ago
  Even in tech circles the terminology is pretty mixed usage wise.
- stochastic_monk 7y ago
  Some are brilliant (e.g., Ronan Farrow), but the real point is that they’re speaking to an audience which they’re essentially trying to coddle because the audience isn’t comprised of experts.
  - newswriter99 7y ago
    You're on to something but it's a tiny bit more complicated than that. Take general assignment reporters for example. They have to learn how to learn. What I mean is, they're experts on digesting new information. Because they have to write about ANYTHING at a moment's notice, and can't be expected to be experts on everything. THEN they have to write about that topic using only 500 words (or so) to an audience who also probably knows nothing about the topic. That's a tall order and you shouldn't be surprised reporters get it wrong sometimes.
- newswriter99 7y ago
  Probably worth noting I've been in journalism going on a decade now. It's a bit too easy to simply write off ALL journalists (no pun intended) as "not that bright". You may as well say most people aren't that bright. Which would be equally unfair. Likewise, how can you stick a small-town reporter who covers highschool basketball in the same list as a New York Times reporter with an Ivy League background in economics? Make no mistake, I'm not implying the latter is somehow superior to the former, but there is a huge range between the people who make up the journalism industry.

joeyrideout 7y ago

I've been wondering lately, would it be at all feasible for a "ransom bounty" program to exist? A platform similar to HackerOne except to act as a middleman between companies (with specific rules of engagement) and attackers who can plant "friendly" non-damaging ransomware (or the real thing on a designated target box) in exchange for a bounty and report of vulnerabilities. The major caveat would be the general limitation of most bounty programs against social engineering and phishing...

DyslexicAtheist 7y ago

any non paywalled links?

oldjokes 7y ago

Replace "cities" with "any organization that is not tech first" and you'll still find hundreds of win 7/vista/xp machines that have never been patched, and ad-hoc network closet/cloud hybrid rigged solutions for everything. There is literally no way to fix all this dumb fragile infrastructure without a massive government program that accepts responsibility for doing so. You need thousands of smart people going through every machine, all the software, all the systems. These people are never going to work for Baltimore or for Maersk, not in a million years. Instead let's create a new government agency or pivot the NSA from it's dumb paranoid reactionary posture to more of a proactive NIST-style advisory role on best practices, have them hack everything domestically and start fixing things as their core mission. Make sure nobody at state or DHS or justice can subvert this new agency, they need to stand on equal footing with any company or agency. Then hopefully pillage all the miserable smart people who are currently working at mega corps and agencies who actually want to do positive, meaningful work for a change. Problem solved someone hire me to advise on their political campaign.

qaq 7y ago
"any organization that is not tech first" - thats pretty optimistic looking at a number of the tech first companies that have being breached.
- peterwwillis 7y ago
  I don't know why you got downvoted. I know plenty of companies with modern tech that absolutely suck at security. Security is just hard, and it's not easier just because you're a tech company. By comparison, if you spend billions of dollars on a modern building, I can still probably break into it with just a can of compressed air. I doubt the design plans for the building included "mitigate compressed air attacks", and it's the same with every other kind of organization.
  - throw0101a 7y ago
    > Security is just hard, and it's not easier just because you're a tech company. We're not talking about everyone having Red Teams here. We're talking about keeping up to date with regards to Patch Tuesday, or even just having an OS that still actually gets patches. That'll get us 80-90% of the way to decent security: > “Almost two months passed between the release of fixes for the EternalBlue vulnerability and when ransomware attacks began,” Microsoft warned. “Despite having nearly 60 days to patch their systems, many customers had not. A significant number of these customers were infected by the ransomware.” * https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/ https://krebsonsecurity.com/2019/06/report-no-eternal-blue-e...

javagram 7y ago

These type of organizations probably need to be running all chromebooks with a G Suite enterprise account (configured to require all employees to use 2FA). Something that has way less attack surface than what they have now.

bytematic 7y ago
Imagine getting/teaching them to use G Suite accounts, something I've attempted once. I thought it would be the easiest possible transition

Kurtz79 7y ago

Could someone suggest recognized and useful certifications, for those interesting getting into cybersecurity? The article has a link to another mentioning CompTIA and CISSP, are they any good?

dsr_ 7y ago
CISSP is good for getting hired. I'm not sure it proves much about your skills, so much as your vocabulary.
neuralzen 7y ago
CompTIA certs are a mixed bag, some are decent, but many are very surface level. CISSP is broad, and more managerial level, but certainly worthwhile. But if you'd like some in the trenches stuff, I'd suggest the OSCP.
driverdan 7y ago
Study to learn skills, not to get certs.
- Kurtz79 7y ago
  Any suggestion on good study material, then? A lot of resources seems to be more like games than something applicable to the real world.

true_tuna 7y ago

Stop posting WSJ paywall articles. This isn’t a paywall advertisement service.

dang 7y ago
If there's a workaround, it's ok. Users usually post workarounds in the thread. This is in the FAQ at https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html and there's more explanation here: https://news.ycombinator.com/item?id=10178989 https://news.ycombinator.com/item?id=10178989 https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix&page=0&query=by:dang%20paywall https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...
- craftyguy 7y ago
  If there's a workaround and it's not hard for people to find it and paste it into the comments, then it's not hard for people submitting articles to post the non-paywall version in the first place.
  - dang 7y ago
    It's important that the original URL be used so that readers can see what the domain is. It's for that same reason that HN doesn't allow link shorteners.

neonate 7y ago

http://archive.is/AXk1l http://archive.is/AXk1l

parliament32 7y ago

Paywalled, non-paywall link: https://www.wsj.com/articles/u-s-cities-strain-to-fight-hackers-11559899800?mod=rsswn https://www.wsj.com/articles/u-s-cities-strain-to-fight-hack... https://archive.fo/AXk1l https://archive.fo/AXk1l

bluedino 7y ago

I'm painting with a broad brush here, but a lot of government employees do as little as possible. They are union protected, so they can stay in their jobs for a very long time. So you get a lot of the thing in IT where someone has 20 years of 1 year experience. I'm sure the budgets aren't great and the rest of the government isn't pushing tech, but you end up with a lot of 'it works fine just leave it as is'

moosey 7y ago
> I'm painting with a broad brush here, but a lot of government employees do as little as possible. Welcome to humanity. How many people actually devote their lives to the improvement of the human condition, or have a devotion to even the jobs that they are working for? I fear that treating your job with the devotion necessary to do it truly effectively means that you limit yourself and future opportunities, because you must devote time to your own growth. And how many people are interested in devotion to any cause or personal growth? Personal growth is hard, and devotion to a cause, a serious one especially, is equally painful. Understanding climate change, for instance, is so painful that people reject it in its entirety; it could be because it is a direct refutation to their world view, or because the idea is just so uncomfortable on its face. I feel as if Ada Palmer had it right when she suggests that the first rule of Utopians must be "I hereby renounce the right to complacency, and vow lifelong to take only what minimum of leisure is necessary to my productivity, viewing health, happiness, rest, and play as means, not ends". I think that's too much weight for the vast majority of humanity, and understandably so. In America it feels as if the way society is structured is designed to sap willpower (for example: the Atomic Family). I can think of a number of reasons why this might actually be the planned outcome of its current design.

nwalker85 7y ago

There is a big industry starting to spring up around this, data insurance. Go to any big insurance conference and all they are talking about right now is cyber insurance. Construction companies are asking for it for example; they've always had to insure their employees, but now they are seeing things like their offices being hit by cryptolockers and being extorted for bitcoin by Russians. They can't afford to lose productivity over something like that so they are getting insured. Those insurance agencies are working with security consultants to help harden the networks too. So yes, this is definitely a big problem, but the wheels are already moving to start addressing this issue, because there is money to be made.

thephyber 7y ago
It's not clear how valuable cybersecurity insurance will be if there is no coverage for "acts of war" or if the insurer claims the insured didn't do enough to protect/defend against it. [1] [1] https://www.lawfareblog.com/moment-truth-cyber-insurance https://www.lawfareblog.com/moment-truth-cyber-insurance

4ntonius8lock 7y ago

I'm surprised no one has mentioned it here on hacker news. But when CFAA makes all hacking criminal, the only hackers left are criminals. Ethically motivated hackers should have the same protections as whistle blowers - The day that happens, the world becomes more safe and transparent. But transparency is not what everyone wants, obviously. I wish I was more surprised that mainstream media fails to mention this important part of the state of cyber security in the US.

AgentME 7y ago
In the process of using a town's court website to try to pay a parking ticket, I practically-accidentally found a security vulnerability in it. The vulnerability immediately showed me many people's personal information. I closed the page when I realized what had happened. I didn't report the issue because I was worried that the people running a small town's buggy court website might be more interested in figuring out what laws I broke than understanding the issue. I'd rather have nothing to do with it. It's the only time I haven't reported a security vulnerability I've found. I'm probably over-thinking it, but when there's other groups that invite vulnerability reports and even give bug bounties, it just feels like an unnecessary risk reaching out to ones that don't.
- 4ntonius8lock 7y ago
  Over thinking it? I don't think so. 35 years of jail time has a powerful chilling effect. How this article could talk about the 'surprising' lack of ethical hackers without covering this law and it's abuse is beyond me. It's like talking about the 'surprising lack of research into clinical MDMA studies' and not talk about the war on drugs. It's like they are intentionally ignoring the HUGE elephant in the room.

elipsey 7y ago

How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process. Also, in my experience working for state government, engineers were considered a waste of money. Hiring was difficult because they wouldn't pay anywhere close to the market rate, and techies weren't allowed to earn more then managers. There was a parade of sales people pitching the director to lay off the devs and outsource everything, and then pat each other on the back for "slashing government waste." It seems like most of their apps should in principal should not need to have been completely reinvented from scratch, but having people who don't work here responsible for security causes an agent-principle problem; from the point of view of the contractors who don't care about your security and the bureaucrats who don't understand it, everything except management is just a cost center. If you do manage to fix anything, the new director will throw it away and start over with a new vendor contract next election. Also, if you are paid by the gvt and are not a cop or a politician, you will be despised as a "useless feeder" and face the risk or furlough, de-funding, re-org, hiring freezes, etc, that make it hard to reliably get anything done. If the public doesn't want a public sector, why fight them by trying to work there? I think Schneier was right to point out that security is an economic externality, and that a high level political solution is likely necessary. https://www.schneier.com/essays/archives/2007/01/information_security_1.html https://www.schneier.com/essays/archives/2007/01/information... EDIT: A couple of people here have pointed out that a "cyber" insurance industry is emerging. I find this encouraging because it at least seems possible for that to be a politically acceptable mechanism for pricing security; your premiums could be contingent on compliance as determined by the insurer, who has skin in the game to understand security and hire real professionals as auditors. I'm not sure how that translates to actually fixing security, but it seems like a start.

meesles 7y ago
100% agreed. I've always found it very ironic that governments want the best and brightest when they never pay market rates. Not only do they want the best and brightest, they want them to selflessly serve their country at the cost of financial advancement. Is it surprising that they end up getting the lower end of the crop? https://18f.gsa.gov/ https://18f.gsa.gov/ was a fantastic move and exactly what we need. Unfortunately, it took a group of extremely successful private sector individuals to give up their careers temporarily in pursuit of fixing something.

wehack 7y ago

Do you need hackers for hire? Do you need to keep an eye on your spouse by gaining access to their emails? As a parent do you want to know what your kids do on a daily basis on all social networks in others to make sure they're not getting into trouble? Whatever it is, Ranging from Bank Jobs, Flipping cash, Criminal records, removal of mugshots ,DMV, Taxes, crypto currency fraud investigation Name it, they can get the job done www dot assured hacks dot com