4 ms·

> If their aim was the highest level of security Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive t

by iuguy 16y ago

> If their aim was the highest level of security Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. If their source code was stolen, then yes you could say that the level of protection was inappropriate because if the source code is the highest value asset they have, it probably shouldn't be accessible from the Internet. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet.

stcredzero 16y ago
Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Putting words in my mouth. No one said anything about perfect security. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. And they did not do this. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. Of course. It does not follow that breaking into the web server should compromise the mail server, or vice-versa. You're really losing me there. What you're saying is that they saved what was likely a small amount of money in exchange for a large amount of security. (All of the corporate emails.) I wouldn't want security work from a company as short sighted as that. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet. I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised.
- iuguy 16y ago
  > Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. If that's not what you meant then I'm sorry for reading too much into it. > And they did not do this Which I feel more inclined to agree with rather than claiming they failed because they didn't meet the highest level of security. However, a compromise doesn't necessarily mean that they didn't do enough - as TJX would be happy to tell you. Compromises happen, if they didn't we wouldn't be in business. > Of course. It does not follow that breaking into the web server should compromise the mail server, or vice-versa. You're really losing me there. It depends - it's not clear whether or not these are the same server. As well as this what's important is that someone somewhere in HBGary considered the possibility of getting hacked as part of a process to determine what countermeasures they should look to put in place. It might not have been a small amount of money, they might have saved a lot or nothing. Having mail servers compromised is embarrassing but shouldn't be the end of the world - because anything that would cause real pain you would have to expect countermeasures for. Where this gets interesting is that with some of the documents Mr. Barr has not considered the possibility that his account might get hacked. If you don't consider your defences compromised to begin with, you're likely to compromise on your defences. The issue isn't 4 Gig of mail has been leaked, the issue is more to do with whether or not anything sensitve should've been encrypted. Of course, we're all only human and make mistakes, but dealing with this will be part of paying for them. > I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised. I've no doubt you could find someone who'd claim that they could do it, but it's all going to depend on the architecture, configuration, software and maintenance involved. FWIW I don't believe that HBGary used a company for their mail, I read somewhere that Aaron Barr was the administrator - perhaps that was an oversight on HBGary's part given comments about his personality by other staff members.
  - stcredzero 16y ago
    > Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. Given the opportunity, you choose a mediocre interpretation instead of the most intelligent one. (Actually, that's charitable. You ascribed an idea to me that everyone knows doesn't exist.) This results in a lower level of discussion. > I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised. I've no doubt you could find someone who'd claim that they could do it, but it's all going to depend on the architecture, configuration, software and maintenance involved. FWIW I don't believe that HBGary used a company for their mail, I read somewhere that Aaron Barr was the administrator And how isn't this a red flag for organizational incompetence at HBGary?
moe 16y ago
I'm not sure what all this beating around the bush is about. They're calling themselves a "security firm" (at least that's how everyone refers to them) and they engage in cyber-warfare against anonymous. Having your mailserver compromised on that premise, during what was probably the first serious attack, disqualifies you from that game. And by the way, how do you know their source code was not stolen or backdoored? There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Excuse me? "Absolutely perfect security"? This was not some minor breach into some peripheral webserver. 4.71GB of their E-Mail is on BitTorrent[1]. [1] http://thepiratebay.org/torrent/6156166/HBGary_leaked_emails http://thepiratebay.org/torrent/6156166/HBGary_leaked_emails
- iuguy 16y ago
  > They're calling themselves a "security firm" (at least that's how everyone refers to them) and they engage in cyber-warfare against anonymous. Random acts of stupidity by individual actors that should know better do not qualify as cyber-warfare. > Having your mailserver compromised on that premise, during what was probably the first serious attack, disqualifies you from that game. I sincerely doubt that was the first attack on their infrastructure and applications. We're routinely attacked by targeted threats and we're even smaller than HBGary. > And by the way, how do you know their source code was not stolen or backdoored? I don't, but I will be asking about it when I speak to them, as will everyone else they speak to. Hopefully they will segregate the code from the Internet. > Excuse me? "Absolutely perfect security"? > This was not some minor breach into some peripheral webserver. 4.71GB of their E-Mail is on BitTorrent And what's the value of the information assets stored in that e-mail? Is it 4.71Gb of subscription reminders for icanhazcheezburger? What proportion of that mail is actually sensitive and unencrypted, or decryptable within a timeframe where the sensitivity is still relevant? This is the thing, it's easy to scream about volume, but the fact is that there's a lot of data to go through. We've already seen stuff leak out from it that realistically was not best placed to be sent around unencrypted, but the same would apply in any company that had their mail servers broken into, the mail stolen and then distributed across the Internet.
  - 16y ago
bmelton 16y ago
"There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong." I wouldn't use a dentist with bad teeth. I wouldn't get my hair cut by somebody with a bad hair cut. I wouldn't let my garden be tended by someone with an ugly yard. You're completely right, they don't have to have absolutely perfect security, but it's a business card in the same way that getting all your data hacked and posted to the Pirate Bay is an anti-business card.

by iuguy 16y ago

stcredzero 16y ago

Which nobody has stated was there aim. There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Putting words in my mouth. No one said anything about perfect security. Security firms should aim for the most appropriate level of security to protect their information assets based on a reasonable approach. As should everyone else. And they did not do this. That an Internet-facing web app was broken into and an email server for receiving and sending email to and from the Internet means that they have to be connected to the Internet to work. Of course. It does not follow that breaking into the web server should compromise the mail server, or vice-versa. You're really losing me there. What you're saying is that they saved what was likely a small amount of money in exchange for a large amount of security. (All of the corporate emails.) I wouldn't want security work from a company as short sighted as that. If these systems contained information assets that were sufficiently sensitive to the point of considering post-compromise lateral movement then they probably shouldn't be connected to the Internet. I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised.

iuguy 16y ago
> Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. If that's not what you meant then I'm sorry for reading too much into it. > And they did not do this Which I feel more inclined to agree with rather than claiming they failed because they didn't meet the highest level of security. However, a compromise doesn't necessarily mean that they didn't do enough - as TJX would be happy to tell you. Compromises happen, if they didn't we wouldn't be in business. > Of course. It does not follow that breaking into the web server should compromise the mail server, or vice-versa. You're really losing me there. It depends - it's not clear whether or not these are the same server. As well as this what's important is that someone somewhere in HBGary considered the possibility of getting hacked as part of a process to determine what countermeasures they should look to put in place. It might not have been a small amount of money, they might have saved a lot or nothing. Having mail servers compromised is embarrassing but shouldn't be the end of the world - because anything that would cause real pain you would have to expect countermeasures for. Where this gets interesting is that with some of the documents Mr. Barr has not considered the possibility that his account might get hacked. If you don't consider your defences compromised to begin with, you're likely to compromise on your defences. The issue isn't 4 Gig of mail has been leaked, the issue is more to do with whether or not anything sensitve should've been encrypted. Of course, we're all only human and make mistakes, but dealing with this will be part of paying for them. > I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised. I've no doubt you could find someone who'd claim that they could do it, but it's all going to depend on the architecture, configuration, software and maintenance involved. FWIW I don't believe that HBGary used a company for their mail, I read somewhere that Aaron Barr was the administrator - perhaps that was an oversight on HBGary's part given comments about his personality by other staff members.
- stcredzero 16y ago
  > Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. Given the opportunity, you choose a mediocre interpretation instead of the most intelligent one. (Actually, that's charitable. You ascribed an idea to me that everyone knows doesn't exist.) This results in a lower level of discussion. > I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised. I've no doubt you could find someone who'd claim that they could do it, but it's all going to depend on the architecture, configuration, software and maintenance involved. FWIW I don't believe that HBGary used a company for their mail, I read somewhere that Aaron Barr was the administrator And how isn't this a red flag for organizational incompetence at HBGary?

moe 16y ago

I'm not sure what all this beating around the bush is about. They're calling themselves a "security firm" (at least that's how everyone refers to them) and they engage in cyber-warfare against anonymous. Having your mailserver compromised on that premise, during what was probably the first serious attack, disqualifies you from that game. And by the way, how do you know their source code was not stolen or backdoored? There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong. Excuse me? "Absolutely perfect security"? This was not some minor breach into some peripheral webserver. 4.71GB of their E-Mail is on BitTorrent[1]. [1] http://thepiratebay.org/torrent/6156166/HBGary_leaked_emails http://thepiratebay.org/torrent/6156166/HBGary_leaked_emails

iuguy 16y ago
> They're calling themselves a "security firm" (at least that's how everyone refers to them) and they engage in cyber-warfare against anonymous. Random acts of stupidity by individual actors that should know better do not qualify as cyber-warfare. > Having your mailserver compromised on that premise, during what was probably the first serious attack, disqualifies you from that game. I sincerely doubt that was the first attack on their infrastructure and applications. We're routinely attacked by targeted threats and we're even smaller than HBGary. > And by the way, how do you know their source code was not stolen or backdoored? I don't, but I will be asking about it when I speak to them, as will everyone else they speak to. Hopefully they will segregate the code from the Internet. > Excuse me? "Absolutely perfect security"? > This was not some minor breach into some peripheral webserver. 4.71GB of their E-Mail is on BitTorrent And what's the value of the information assets stored in that e-mail? Is it 4.71Gb of subscription reminders for icanhazcheezburger? What proportion of that mail is actually sensitive and unencrypted, or decryptable within a timeframe where the sensitivity is still relevant? This is the thing, it's easy to scream about volume, but the fact is that there's a lot of data to go through. We've already seen stuff leak out from it that realistically was not best placed to be sent around unencrypted, but the same would apply in any company that had their mail servers broken into, the mail stolen and then distributed across the Internet.
- 16y ago

bmelton 16y ago

"There's a big misconception that somehow security firms should strive to have absolutely perfect security, which is completely wrong." I wouldn't use a dentist with bad teeth. I wouldn't get my hair cut by somebody with a bad hair cut. I wouldn't let my garden be tended by someone with an ugly yard. You're completely right, they don't have to have absolutely perfect security, but it's a business card in the same way that getting all your data hacked and posted to the Pirate Bay is an anti-business card.