3 ms·

Is it though? There's a significant security bug that has a known fix, on your supercomputer. The second anything remotely security-related happens and it gets

by snoman 7y ago

Is it though? There's a significant security bug that has a known fix, on your supercomputer. The second anything remotely security-related happens and it gets out that you've opted to hedge your bets that no untrusted code will ever execute on that machine... and you could be in some seriously hot water. I'm not really in the HPC space, but I can't really see any vp/cto/cio reasonably putting that asterisk on a security audit. If you've got cyber insurance, you probably wouldn't be able to keep coverage if you did that.

zepearl 7y ago
I agree - factors involving insurance, compliance, auditing, etc... will play a big role for any company using such systems to process any kind of even slightly confidential information. Any CIO that decides not to use such security patches will carry on his/her shoulders the full risk. Big bosses don't like risk and like even less to be personally accountable for anything => I don't see that happening. Even if the tests mentioned in the article might be related to HPC, the HW is for general computing therefore its usage doesn't have to be restricted to HPC, but people might still decide to use (as well) those HPC-results to compare the types of CPUs.
kllrnohj 7y ago
What do you think is the actual risk? Who is attacking whom, and how? If you're running on HPC you basically rented the hardware. It's a time-share system. The entire thing is yours, all yours, for the hours you managed to procure. So who are you attacking? And what vp/cto/cio are you even talking about? The ones who own the hardware, or the ones who are renting it? And why do you think a security policy is needed here at all instead of just, you know, laws & contracts? You can't just anonymously rent time on these systems even if you have the money - you need your usage approved, too, and it's a big whole process. If you then go and successfully launch a security attack, why does that require technical safeguards instead of just the FBI knocking down your door and hauling your ass to jail?

by snoman 7y ago

zepearl 7y ago

I agree - factors involving insurance, compliance, auditing, etc... will play a big role for any company using such systems to process any kind of even slightly confidential information. Any CIO that decides not to use such security patches will carry on his/her shoulders the full risk. Big bosses don't like risk and like even less to be personally accountable for anything => I don't see that happening. Even if the tests mentioned in the article might be related to HPC, the HW is for general computing therefore its usage doesn't have to be restricted to HPC, but people might still decide to use (as well) those HPC-results to compare the types of CPUs.

kllrnohj 7y ago

What do you think is the actual risk? Who is attacking whom, and how? If you're running on HPC you basically rented the hardware. It's a time-share system. The entire thing is yours, all yours, for the hours you managed to procure. So who are you attacking? And what vp/cto/cio are you even talking about? The ones who own the hardware, or the ones who are renting it? And why do you think a security policy is needed here at all instead of just, you know, laws & contracts? You can't just anonymously rent time on these systems even if you have the money - you need your usage approved, too, and it's a big whole process. If you then go and successfully launch a security attack, why does that require technical safeguards instead of just the FBI knocking down your door and hauling your ass to jail?