4 ms·

> IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human n

> IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. I can assure you that many, many security people (I would say all security people, but I have no doubt that there's some laggards working under the radar somewhere) already think like this. This is all part of a multi-layer security strategy, and having encrypted communication on top of a secured physical network is pretty standard and is what a lot of orgs strive for. Unfortunately, it really isn't feasible and it's not because of any decisions by the security people, because... > have all privileged resources only accept connections over VPN This sounds great until you remember that half of your organization runs on legacy software that doesn't play nice with forcing VPNs and your technical architect has informed you that they aren't planned to upgrade to newer software until 2030. This is especially so in government orgs (like NASA).

olliej 7y ago
Then you need to either mandate updating, or isolate those machines.
- txcwpalpha 7y ago
  > mandate updating hahahahahahahahaahaha > isolate those machines that's exactly what is done, but you just said that security people need to stop thinking in those terms, so...?
  - olliej 7y ago
    I work at a company that drops network access to privileged resources of any machine that is more than X days behind installed an update. And isolating the machines: I mean separate networks, or vpn only access to privileged resources. And it goes without saying: traffic from unknown systems on a privileged physical network get dropped at the router.
    - txcwpalpha 7y ago
      >I work at a company that drops network access to privileged resources of any machine that is more than X days behind installed an update. Congratulations to your company! That is quite a great policy. Unfortunately, that would be literally impossible in many of the rest of the world's companies. We aren't talking about dropping access of a desktop machine that's a few days behind on its Windows updates. We're talking about massive, enterprise-spanning systems like mainframes, ERMs, industrial control systems, data pipelines, etc that interface with hundreds of other applications across your company and are 1000% mission critical. Dropping access could quite literally bring the entire company (and all of its revenue) to a grinding halt. And because of their size and importance, they take years and tens of millions of dollars (not an exaggeration; I've been on teams tasked with upgrades like this) to upgrade even when planned half a decade in advance. Companies are complex, and security is not one-size-fits-all. You do what you can and hope for the best, but at some point there's only so much you can do without burning the entire company to the ground and starting all over.

olliej 7y ago

Then you need to either mandate updating, or isolate those machines.

txcwpalpha 7y ago
> mandate updating hahahahahahahahaahaha > isolate those machines that's exactly what is done, but you just said that security people need to stop thinking in those terms, so...?
- olliej 7y ago
  I work at a company that drops network access to privileged resources of any machine that is more than X days behind installed an update. And isolating the machines: I mean separate networks, or vpn only access to privileged resources. And it goes without saying: traffic from unknown systems on a privileged physical network get dropped at the router.
  - txcwpalpha 7y ago
    >I work at a company that drops network access to privileged resources of any machine that is more than X days behind installed an update. Congratulations to your company! That is quite a great policy. Unfortunately, that would be literally impossible in many of the rest of the world's companies. We aren't talking about dropping access of a desktop machine that's a few days behind on its Windows updates. We're talking about massive, enterprise-spanning systems like mainframes, ERMs, industrial control systems, data pipelines, etc that interface with hundreds of other applications across your company and are 1000% mission critical. Dropping access could quite literally bring the entire company (and all of its revenue) to a grinding halt. And because of their size and importance, they take years and tens of millions of dollars (not an exaggeration; I've been on teams tasked with upgrades like this) to upgrade even when planned half a decade in advance. Companies are complex, and security is not one-size-fits-all. You do what you can and hope for the best, but at some point there's only so much you can do without burning the entire company to the ground and starting all over.