4 ms·

> I'm not sure why you're invested in pretending this is super hard, or that it isn't extremely easy to do correctly if it is a company priority to do so. The

> I'm not sure why you're invested in pretending this is super hard, or that it isn't extremely easy to do correctly if it is a company priority to do so. The enormous amounts of money and time that companies spend on this problem, and still not get it right, disproves your assertion of simplicity.

x0x0 7y ago
And yet there's lots of examples of companies that aren't trivially breached, and can promptly roll patches for CVEs.
- g051051 7y ago
  And just as many that are breached in spite of their best efforts. Perfect security is impossible.
  - x0x0 7y ago
    Let's not shift the goalposts from competent to perfect.
    - g051051 7y ago
      Even competent security is difficult, especially at the scale that large companies operate at. Attackers are very sophisticated, and patient.
      - x0x0 7y ago
        Your implicit claim that it's difficult to 1 - know what assets are on what domains 2 - know the code backing them is belied by the many competent orgs that do that. And the fact that it's table stakes for a reasonable security posture. Further, it's not that technically challenging, not least because it can be human automated. Detection tools are available right here: https://www.metasploit.com https://www.metasploit.com for $0. You can have a human run that once a week against your web properties and do way way better than Equifax. Because Metasploit would have alerted on the Struts vuln. It's also not rocket science to have a member of a security team run that against a list of web properties (that can be trivially sourced from your DNS server even if they bypassed internal deployment processes). Nothing about this is sophisticated beyond basic computer skills -- grabbing known sites from your security docs, backing that up with DNS entries, alerting on anything missing, and running metasploit from a script. Unless, of course, you're hellbent on claiming the above is super duper hard.
        g051051 7y ago
        So your proposal is to use less automation, and rely on a human to do a scan? That's one of the reasons Equifax got into this problem in the first place. None of this is trivial, and you saying it is would indicate you really don't understand modern computer security issues. This is hard, and it's unfortunately easy to get wrong. And it's a space where even a tiny failure can lead to large consequences. Not that the Equifax failures were particularly tiny, but it was clearly more than they could handle.

x0x0 7y ago

And yet there's lots of examples of companies that aren't trivially breached, and can promptly roll patches for CVEs.

g051051 7y ago
And just as many that are breached in spite of their best efforts. Perfect security is impossible.
- x0x0 7y ago
  Let's not shift the goalposts from competent to perfect.
  - g051051 7y ago
    Even competent security is difficult, especially at the scale that large companies operate at. Attackers are very sophisticated, and patient.
    - x0x0 7y ago
      Your implicit claim that it's difficult to 1 - know what assets are on what domains 2 - know the code backing them is belied by the many competent orgs that do that. And the fact that it's table stakes for a reasonable security posture. Further, it's not that technically challenging, not least because it can be human automated. Detection tools are available right here: https://www.metasploit.com https://www.metasploit.com for $0. You can have a human run that once a week against your web properties and do way way better than Equifax. Because Metasploit would have alerted on the Struts vuln. It's also not rocket science to have a member of a security team run that against a list of web properties (that can be trivially sourced from your DNS server even if they bypassed internal deployment processes). Nothing about this is sophisticated beyond basic computer skills -- grabbing known sites from your security docs, backing that up with DNS entries, alerting on anything missing, and running metasploit from a script. Unless, of course, you're hellbent on claiming the above is super duper hard.
      - g051051 7y ago
        So your proposal is to use less automation, and rely on a human to do a scan? That's one of the reasons Equifax got into this problem in the first place. None of this is trivial, and you saying it is would indicate you really don't understand modern computer security issues. This is hard, and it's unfortunately easy to get wrong. And it's a space where even a tiny failure can lead to large consequences. Not that the Equifax failures were particularly tiny, but it was clearly more than they could handle.