4 ms·
This article is devoid of any meaningful analysis and perspective. >The cybersecurity unit—responsible for ensuring Capital One’s firewalls were properly confi
by relaunched 7y ago
This article is devoid of any meaningful analysis and perspective.
>The cybersecurity unit—responsible for ensuring Capital One’s firewalls were properly configured and scanning the internet for evidence of a data breach—has cycled through senior leaders and staffers in recent years, according to the people.
Firewall team combined with threat-intel? I'm not sure what that has to do with the breach, or preventing it.
>Sometimes the broader tech-centric culture of the firm could complicate security, the people said. Technology employees had at times been given free rein to write in many coding languages—so many that it made it harder for the cybersecurity unit to spot problems, according to people familiar with the matter.
Super common, but coding languages aren't generally acknowledged as responsible for the hack. If there was a code level vulnerability that most likely would have been caught by static analysis, but wasn't because their scanning tools didn't support a language, this comment would make more sense.
>the alleged hacker found that a computer managing communications between the company’s cloud and the public internet was misconfigured—effectively it had weak security settings, the Journal previously reported.
Server Side Request Forgery, coupled with overpermissioning, could be explained this way - misconfigured WAF. A poor description of the what we think may be the actual exploit.
It goes on and on.
- relaunched 7y agoUpon re-read, I don't mentally equate WAF (which is related to the breach, with Firewalls. In my mind, they are two completely different controls. However, I'm not sure if that's a pervasive perspective or just my own. Therefore, my aforementioned statement about firewalls may or may not be valid. YMMV.
- runamok 7y ago? WAF stands for web application firewall... You don't equate a WAF with a hardware firewall? Just not understanding...
- relaunched 7y agoThe reporter said Firewall. When I read that, I don't think of a WAF, rather a more traditional firewall that separates internet from intranet. If others, including the reporter, generally think of WAFs when they read firewall, then my criticism on this particular point is unfair. For example, if someone listed 2 years of experience with firewall rules, I'd automatically think routing and not WAF rules configuration.
- kjaftaedi 7y agoI have experience with these type of environments. When you allow people to code in different languages and different environments, everyone has different needs. They need different software, which often connects to different network resources. You get endless incidents where users can't program because they can't download a plugin, or their software needs libraries found on the internet, and if the network group is being lazy they could end up opening up more to the internet than they should, because it's too much work to accommodate everyone when there are no standards. Network openings like these scenarios create are enough to infiltrate a company if someone does something as innocuous as clicking a random link on google with a vulnerable browser.
- moltensodium 7y agoIn the olden days, you could sum up the entire information security knowledge and posture of many companies with "we're behind a firewall, so everything is fine". Some companies have not evolved much beyond this attitude, and it shows with ridiculous wording like this.
- icedchai 7y agoIn the real olden days (mid 90's), we had entire offices with public IP addresses and no firewalls!