3 ms·

> Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. If that's not wh

by iuguy 16y ago

> Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. If that's not what you meant then I'm sorry for reading too much into it. > And they did not do this Which I feel more inclined to agree with rather than claiming they failed because they didn't meet the highest level of security. However, a compromise doesn't necessarily mean that they didn't do enough - as TJX would be happy to tell you. Compromises happen, if they didn't we wouldn't be in business. > Of course. It does not follow that breaking into the web server should compromise the mail server, or vice-versa. You're really losing me there. It depends - it's not clear whether or not these are the same server. As well as this what's important is that someone somewhere in HBGary considered the possibility of getting hacked as part of a process to determine what countermeasures they should look to put in place. It might not have been a small amount of money, they might have saved a lot or nothing. Having mail servers compromised is embarrassing but shouldn't be the end of the world - because anything that would cause real pain you would have to expect countermeasures for. Where this gets interesting is that with some of the documents Mr. Barr has not considered the possibility that his account might get hacked. If you don't consider your defences compromised to begin with, you're likely to compromise on your defences. The issue isn't 4 Gig of mail has been leaked, the issue is more to do with whether or not anything sensitve should've been encrypted. Of course, we're all only human and make mistakes, but dealing with this will be part of paying for them. > I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised. I've no doubt you could find someone who'd claim that they could do it, but it's all going to depend on the architecture, configuration, software and maintenance involved. FWIW I don't believe that HBGary used a company for their mail, I read somewhere that Aaron Barr was the administrator - perhaps that was an oversight on HBGary's part given comments about his personality by other staff members.

stcredzero 16y ago
> Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. Given the opportunity, you choose a mediocre interpretation instead of the most intelligent one. (Actually, that's charitable. You ascribed an idea to me that everyone knows doesn't exist.) This results in a lower level of discussion. > I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised. I've no doubt you could find someone who'd claim that they could do it, but it's all going to depend on the architecture, configuration, software and maintenance involved. FWIW I don't believe that HBGary used a company for their mail, I read somewhere that Aaron Barr was the administrator And how isn't this a red flag for organizational incompetence at HBGary?
- iuguy 16y ago
  I think we're talking across purposes here. I'm asserting that the fact that they were compromised isn't particularly bad. People get hit all the time. The fact that they were hit by an SQL injection bug is unfortunate and should've been picked up but these things happen all the time. I'd also say that while they're a security firm they should still be held to the same standards as everyone else, there's nothing inherently special about a security firm being compromised anymore than a plumber's getting a leak - what matters is the damage and how they fix it. The red flags as you call them are not the facts nor the means of the compromise alone, it's the data that is lost and whether or not HBGary Federal a) practiced what they preached and b) followed appropriate processes and policies to protect the information assets according to their sensitivity. My hope is that on balance they did b fairly well and maybe some of a. My expectation is that they did some of a and probably not a lot of b, the results of which would be the red flag. Again, I don't think that security companies should be held to higher standards than others as on balance we tend to hold less sensitive data than our customers (although that which we hold we should handle correctly). If this were an online pet shop people would talk about the attacks being quite advanced, laugh a little and move on. HBGary Federal aren't the first security firm to get hacked into and won't be the last.
  - stcredzero 16y ago
    there's nothing inherently special about a security firm being compromised anymore than a plumber's getting a leak - what matters is the damage and how they fix it. A word of advice: If a plumber gets a leak, it's no big deal. If a plumber's office gets massive but avoidable water damage through their short-sighted incompetence, don't hire them.
    - sambe 16y ago
      You don't think there's any truth in "the cobbler's children have no shoes"?
      - stcredzero 16y ago
deleted 16y ago
[deleted]

by iuguy 16y ago

stcredzero 16y ago

> Putting words in my mouth. No one said anything about perfect security. No, you mentioned the highest level which I took to read as perfect. Given the opportunity, you choose a mediocre interpretation instead of the most intelligent one. (Actually, that's charitable. You ascribed an idea to me that everyone knows doesn't exist.) This results in a lower level of discussion. > I bet I could find a company that could set up an email server that couldn't be compromised just because the web server was compromised. I've no doubt you could find someone who'd claim that they could do it, but it's all going to depend on the architecture, configuration, software and maintenance involved. FWIW I don't believe that HBGary used a company for their mail, I read somewhere that Aaron Barr was the administrator And how isn't this a red flag for organizational incompetence at HBGary?

iuguy 16y ago
I think we're talking across purposes here. I'm asserting that the fact that they were compromised isn't particularly bad. People get hit all the time. The fact that they were hit by an SQL injection bug is unfortunate and should've been picked up but these things happen all the time. I'd also say that while they're a security firm they should still be held to the same standards as everyone else, there's nothing inherently special about a security firm being compromised anymore than a plumber's getting a leak - what matters is the damage and how they fix it. The red flags as you call them are not the facts nor the means of the compromise alone, it's the data that is lost and whether or not HBGary Federal a) practiced what they preached and b) followed appropriate processes and policies to protect the information assets according to their sensitivity. My hope is that on balance they did b fairly well and maybe some of a. My expectation is that they did some of a and probably not a lot of b, the results of which would be the red flag. Again, I don't think that security companies should be held to higher standards than others as on balance we tend to hold less sensitive data than our customers (although that which we hold we should handle correctly). If this were an online pet shop people would talk about the attacks being quite advanced, laugh a little and move on. HBGary Federal aren't the first security firm to get hacked into and won't be the last.
- stcredzero 16y ago
  there's nothing inherently special about a security firm being compromised anymore than a plumber's getting a leak - what matters is the damage and how they fix it. A word of advice: If a plumber gets a leak, it's no big deal. If a plumber's office gets massive but avoidable water damage through their short-sighted incompetence, don't hire them.
  - sambe 16y ago
    You don't think there's any truth in "the cobbler's children have no shoes"?
    - stcredzero 16y ago

deleted 16y ago

[deleted]