7 ms·

Not discounting this story, but I’d like to point out that raising concerns is a personal protective strategy for any cyber staff. If you constantly raise conce

Not discounting this story, but I’d like to point out that raising concerns is a personal protective strategy for any cyber staff. If you constantly raise concerns that you know cannot or will not be resolved, you have created a paper trail scapegoat for when something goes wrong. The more ambiguous the better: firewall settings not monitored enough, Too much turnover something will fall through cracks, Etc Protecting a large enterprise from cyber attacks is basically impossible, so coping with that stress and protecting your career by looking for other things to blame makes sense to me.

trabant00 7y ago
That is an unfair blow. What can you do as an individual in an organization that does not value security and sees it as a sunken cost? I found myself in that position multiple times and I am a sysadmin not security guy. I have no formal responsability in that position and no incentive for covering my ass. But I still have fights with management about it.
- chii 7y ago
  you don't, except to cover your ass. And so the problem remains unsolved. The law, and regulation, needs to step in. It should be as frowned upon by the law as a restaurant not meeting sanitation requirements.
  - trabant00 7y ago
    > you don't, except to cover your ass. You might want to read my reply once more. > And so the problem remains unsolved. Why do you talk about things you don't know? I've scored multiple victories on that front. > The law, and regulation, needs to step in. I work in PCI environments. The regulations are there but few companies follow them except on paper to cover their ass. Regulations are not the solution. People are. We need to fight.
    - 50656E6973 7y ago
      PCI regulations are weak and do little to cover the majority of threats.
  - deleted 7y ago
    [deleted]
- ryanmarsh 7y ago
  IMHE Cap One took security very seriously although security expertise was not diffuse. Frankly I’m surprised their policy enforcement measures didn’t catch the misconfigured app.
tempguy9999 7y ago
Let me help. In the first paragraph it says > and a failure to promptly install some software to help spot and defend against hacks so against your "cannot or will not be resolved" you have actual software being actually not installed (and that's on top of other bad smells at the company listed in the article). > Protecting a large enterprise from cyber attacks is basically impossible Absolute garbage. You seem to be confused about 'protecting against' vs 'making invulnerable'. An you profile actually claims you have "Fintech CTO background [...] including risk analysis" - honestly what on earth made you post such a thing?
- ownagefool 7y ago
  To be fair, this could go either way. Some Cyber Sec professionals are all about the products, but often it's just a barrage of random crap that doesn't really do anything and no strategic planning used in an attempt to paper over the fact they have no skills in the area they're buying for. Sometimes it's easier to just install it, but engineering budget _is_ a zero sum game, so wasting time adding random binaries, that sometimes actually increase risk, is something you can see being ignored. Further, the specific attack didn't require any more monitoring tools that were already claimed to have been configured. They just weren't using them properly. P.S. Given there was a high churn in InfoSec staff, I could totally imagine them all asking for their pet products and then raising concerns when they don't get it. This is typical in dysfunctional orgs.
close04 7y ago
> Protecting a large enterprise from cyber attacks is basically impossible But protecting it from easily preventable cyber attacks "of opportunity" is perfectly possible if you have capable management. They are responsible with building a team of good engineers, trusting them when they raise concerns, and acting on those concerns. Of course for mediocre management teams who are unable to do any of the above this is always a CYA exercise. When you're the person with the budget and the decision power you need to come up with solutions not excuses. This is not a "falling through the cracks" situation. This is a "let's put a tarp instead of a door and hope nobody will notice". Ensuring the physical security of a large enterprise 100% of the time is basically impossible but if someone just walks in by your security staff in the middle of the day and walks out with a rack from the DC then you have a management problem.
empath75 7y ago
I’m discounting the story. Some of the complaints are ridiculous. ‘Too many different languages’?
- owenmarshall 7y ago
  For an appsec team to have a chance in hell they need to be able to understand the application code, no? This seems like a reasonable complaint given that it’s a problem for polyglot dev teams.
  - Nasrudith 7y ago
    Technically if addressing the flaws that deep can be valid. But this was major low hanging fruit - not having proper protection on their cloud servers was what made this breach and that is a config not a language issue on the technical end. On the management end it is an issue of utter user technical incompetence.
  - mistrial9 7y ago
    diversity of code base is a strength, except to vendors and pointy-haired ones
  - outworlder 7y ago
    > For an appsec team to have a chance in hell they need to be able to understand the application code, no? No, especially for networked services. There is a lot of homework that has to happen for security teams to even begin to look into the actual source code. What you need to learn is how the application interacts with the outside world and how to secure those mechanisms. It can be a black box – and for the most part it should, otherwise you'll be bogged down in minutia while there are big holes waiting to be plugged. What you may need to understand in more depth is the protocols in use and access controls. But again, the programming language or the exact code matters little. Even if you have to do stuff like correctness proofs, congratulations! You are now part of the development team. Now you need to add security folks to look into the big picture again.
runamok 7y ago
I am becoming certain that every company will get penetrated at some point. E.g. a poorly configured WordPress box... What happens next is what matters. Least privilege, prevent east west movement, logging aggregation with anomaly detection, notice data exfil, etc. Defense in depth is what matters.

trabant00 7y ago

That is an unfair blow. What can you do as an individual in an organization that does not value security and sees it as a sunken cost? I found myself in that position multiple times and I am a sysadmin not security guy. I have no formal responsability in that position and no incentive for covering my ass. But I still have fights with management about it.

chii 7y ago
you don't, except to cover your ass. And so the problem remains unsolved. The law, and regulation, needs to step in. It should be as frowned upon by the law as a restaurant not meeting sanitation requirements.
- trabant00 7y ago
  > you don't, except to cover your ass. You might want to read my reply once more. > And so the problem remains unsolved. Why do you talk about things you don't know? I've scored multiple victories on that front. > The law, and regulation, needs to step in. I work in PCI environments. The regulations are there but few companies follow them except on paper to cover their ass. Regulations are not the solution. People are. We need to fight.
  - 50656E6973 7y ago
    PCI regulations are weak and do little to cover the majority of threats.
- deleted 7y ago
  [deleted]
ryanmarsh 7y ago
IMHE Cap One took security very seriously although security expertise was not diffuse. Frankly I’m surprised their policy enforcement measures didn’t catch the misconfigured app.

tempguy9999 7y ago

Let me help. In the first paragraph it says > and a failure to promptly install some software to help spot and defend against hacks so against your "cannot or will not be resolved" you have actual software being actually not installed (and that's on top of other bad smells at the company listed in the article). > Protecting a large enterprise from cyber attacks is basically impossible Absolute garbage. You seem to be confused about 'protecting against' vs 'making invulnerable'. An you profile actually claims you have "Fintech CTO background [...] including risk analysis" - honestly what on earth made you post such a thing?

ownagefool 7y ago
To be fair, this could go either way. Some Cyber Sec professionals are all about the products, but often it's just a barrage of random crap that doesn't really do anything and no strategic planning used in an attempt to paper over the fact they have no skills in the area they're buying for. Sometimes it's easier to just install it, but engineering budget _is_ a zero sum game, so wasting time adding random binaries, that sometimes actually increase risk, is something you can see being ignored. Further, the specific attack didn't require any more monitoring tools that were already claimed to have been configured. They just weren't using them properly. P.S. Given there was a high churn in InfoSec staff, I could totally imagine them all asking for their pet products and then raising concerns when they don't get it. This is typical in dysfunctional orgs.

close04 7y ago

> Protecting a large enterprise from cyber attacks is basically impossible But protecting it from easily preventable cyber attacks "of opportunity" is perfectly possible if you have capable management. They are responsible with building a team of good engineers, trusting them when they raise concerns, and acting on those concerns. Of course for mediocre management teams who are unable to do any of the above this is always a CYA exercise. When you're the person with the budget and the decision power you need to come up with solutions not excuses. This is not a "falling through the cracks" situation. This is a "let's put a tarp instead of a door and hope nobody will notice". Ensuring the physical security of a large enterprise 100% of the time is basically impossible but if someone just walks in by your security staff in the middle of the day and walks out with a rack from the DC then you have a management problem.

empath75 7y ago

I’m discounting the story. Some of the complaints are ridiculous. ‘Too many different languages’?

owenmarshall 7y ago
For an appsec team to have a chance in hell they need to be able to understand the application code, no? This seems like a reasonable complaint given that it’s a problem for polyglot dev teams.
- Nasrudith 7y ago
  Technically if addressing the flaws that deep can be valid. But this was major low hanging fruit - not having proper protection on their cloud servers was what made this breach and that is a config not a language issue on the technical end. On the management end it is an issue of utter user technical incompetence.
- mistrial9 7y ago
  diversity of code base is a strength, except to vendors and pointy-haired ones
- outworlder 7y ago
  > For an appsec team to have a chance in hell they need to be able to understand the application code, no? No, especially for networked services. There is a lot of homework that has to happen for security teams to even begin to look into the actual source code. What you need to learn is how the application interacts with the outside world and how to secure those mechanisms. It can be a black box – and for the most part it should, otherwise you'll be bogged down in minutia while there are big holes waiting to be plugged. What you may need to understand in more depth is the protocols in use and access controls. But again, the programming language or the exact code matters little. Even if you have to do stuff like correctness proofs, congratulations! You are now part of the development team. Now you need to add security folks to look into the big picture again.

runamok 7y ago

I am becoming certain that every company will get penetrated at some point. E.g. a poorly configured WordPress box... What happens next is what matters. Least privilege, prevent east west movement, logging aggregation with anomaly detection, notice data exfil, etc. Defense in depth is what matters.