4 ms·

Reading the audit, this kind of confirms my base question when building infrastructure: If people don't do the right thing the business needs, why is it too har

by tetha 7y ago

Reading the audit, this kind of confirms my base question when building infrastructure: If people don't do the right thing the business needs, why is it too hard to do? Can't we reduce the pain to do the right thing so doing the lazy / wrong thing is harder? People not doing thing tends to be an indication of boundaries and responsibilities being drawn in bad ways. Something like the log reviews are a classical thing. Training a sysadmin to know all the new hot attacks and patterns they cause in a log is hard, because that world moves fast. It'd be much more effective to task the admin with a well-defined, easily monitored task: <Ship logs to splunk. Make sure logs are always shipped to splunk>. Might need some definition about format and which logs, but all logs go to splunk. And then it's the security guys job to look for malicious patterns in those logs, probably automatically. Ideally with something simple, like elastic-alert, logstash, you name it, from my own stack. Similar, why do people have to manually enter systems into the host database? It depends on how far you want to automate that, but firewall all systems to access the central registry only, and widen the firewall after an authorized registration of the system. That way, the admins just have to rack systems with a usb stick with some credentials, and it goes or it doesn't. If basic things are so hard people don't do them, something is structurally wrong.

txcwpalpha 7y ago
> but firewall all systems to access the central registry only, and widen the firewall after an authorized registration of the system. That way, the admins just have to rack systems with a usb stick with some credentials, and it goes or it doesn't. Someone first has to build this system, and after accounting for all of the red tape and approvals and training and new audits required and tallying up the total man-hours required to implement, your solution that is supposed to be "less hard" might actually be much harder than the previous system. It's pretty easy to come up with a multitude of ideas to fix issues like this, but it's another thing entirely to actually implement them, especially in a big government org like NASA. Obviously their current/previous system isn't working and they need to fix it, but I think you would be surprised at how difficult it is to do something even as simple as the system you've conceptualized. Just to give a small anecdote: I've built asset management systems, and in one case at a major F500 company, one that used USB sticks for something similar to what you're describing. Just getting the approval to purchase the USB sticks and establish a process for properly handling the USB sticks once credentials were put on them was something that, by itself, took months.
- tetha 7y ago
  Yeah, size is one matter, technology focus is another one. We've been acquired by a bigger shop with a lot less technology focus and exactly what you're describing is already happening. Things that should take 2 month waiting for customers already takes 1 month of planning and 2 month of scheduling the person that might be able to schedule the task of 2 month within the next 6 month or more probably never. It's a soft spot for me atm, because if that's the new norm, it'll be time to leave a lot of work behind.
xorcist 7y ago
Why it's hard? That's because it's actual work, and it's going to be the first thing that's overlooked because the business side doesn't really want it until it's too late. That's not unique to security of course, resiliency and availability has always battled the same problems. Your suggestions seem to focus a lot on box-ticking. Logs are shipped to someone else. Check! Clearance must be sought to install new machines. Check! None of these practices are strange in themselves, but they also needs to work. It doesn't really matter if you ship your logs to someone else if that someone lacks the the resources, competence, or general interest to read them. And, frankly, if your sysadmins can't be trusted to monitor logs, why would you think someone else is? Larger organization have security specialists, but that is on top of the ops specialists, no instead of. Please don't think your suggestions are bad. They aren't, they're mostly good. But they're also exactly how these situations arise. When installation becomes bottlenecked people start taking shortcuts. Someone focuses a little bit too much on ticking boxes, while only pushing problems around as they go unsolved. The article describes a good real world example. These people had most of the processes in place. All the inventory databases and log handling and access control were in place. It's just that they were crap implementations and nobody found themselves in a position to fix it.
bumby 7y ago
One problem is workforce allocation. The argument above is based on the assumption of segregated duties. Some antiquated organizations may have the "sys admin" that is also the "security guy", as well as the backup "software developer", "software QA" etc. because the organization's priorities are elsewhere.

by tetha 7y ago

txcwpalpha 7y ago

> but firewall all systems to access the central registry only, and widen the firewall after an authorized registration of the system. That way, the admins just have to rack systems with a usb stick with some credentials, and it goes or it doesn't. Someone first has to build this system, and after accounting for all of the red tape and approvals and training and new audits required and tallying up the total man-hours required to implement, your solution that is supposed to be "less hard" might actually be much harder than the previous system. It's pretty easy to come up with a multitude of ideas to fix issues like this, but it's another thing entirely to actually implement them, especially in a big government org like NASA. Obviously their current/previous system isn't working and they need to fix it, but I think you would be surprised at how difficult it is to do something even as simple as the system you've conceptualized. Just to give a small anecdote: I've built asset management systems, and in one case at a major F500 company, one that used USB sticks for something similar to what you're describing. Just getting the approval to purchase the USB sticks and establish a process for properly handling the USB sticks once credentials were put on them was something that, by itself, took months.

tetha 7y ago
Yeah, size is one matter, technology focus is another one. We've been acquired by a bigger shop with a lot less technology focus and exactly what you're describing is already happening. Things that should take 2 month waiting for customers already takes 1 month of planning and 2 month of scheduling the person that might be able to schedule the task of 2 month within the next 6 month or more probably never. It's a soft spot for me atm, because if that's the new norm, it'll be time to leave a lot of work behind.

xorcist 7y ago

Why it's hard? That's because it's actual work, and it's going to be the first thing that's overlooked because the business side doesn't really want it until it's too late. That's not unique to security of course, resiliency and availability has always battled the same problems. Your suggestions seem to focus a lot on box-ticking. Logs are shipped to someone else. Check! Clearance must be sought to install new machines. Check! None of these practices are strange in themselves, but they also needs to work. It doesn't really matter if you ship your logs to someone else if that someone lacks the the resources, competence, or general interest to read them. And, frankly, if your sysadmins can't be trusted to monitor logs, why would you think someone else is? Larger organization have security specialists, but that is on top of the ops specialists, no instead of. Please don't think your suggestions are bad. They aren't, they're mostly good. But they're also exactly how these situations arise. When installation becomes bottlenecked people start taking shortcuts. Someone focuses a little bit too much on ticking boxes, while only pushing problems around as they go unsolved. The article describes a good real world example. These people had most of the processes in place. All the inventory databases and log handling and access control were in place. It's just that they were crap implementations and nobody found themselves in a position to fix it.

bumby 7y ago

One problem is workforce allocation. The argument above is based on the assumption of segregated duties. Some antiquated organizations may have the "sys admin" that is also the "security guy", as well as the backup "software developer", "software QA" etc. because the organization's priorities are elsewhere.