4 ms·

For any of these multi-billion dollar organizations you have worked at or have sufficient trustworthy information about, do you think any of them would be able

by Veserv 7y ago

For any of these multi-billion dollar organizations you have worked at or have sufficient trustworthy information about, do you think any of them would be able to withstand a competent pentesting organization with a $1 Million contract to breach their systems? As a corollary, if they implemented all of the suggestions of a type 2, technical CTO/CIO, do you believe they would be able to withstand such a pentest, and if so what would you estimate the cost to totally compromise their systems be? All of my outsider knowledge indicates that none of the multi-billion dollar organizations can protect themselves from adversaries 1/1000th their size, and I would like to know if this is consistent with the knowledge of people with more direct firsthand experience. Thanks.

Enginerrrd 7y ago
I'd venture to guess this is almost a natural law. Look at the pathogen/organism relationship in life. A small attacker with low overhead can cripple a large complex organism. That's been evolving for billions of years without resolution. In essence, I imagine that security vs cost is an exponential curve with security being the independent variable, and cost the dependent variable. At the lowest levels, this is great because there's some very easy and cheap fixes to get large gains in security, but at the high end, each incremental gain increases in cost until it reaches beyond the realm of feasibility. Air gap all your computers? Cool, you just killed productivity which massively increased costs. Actively supervise every user? There's some niche systems that probably require this level of security, but it's rare. Even then, I don't think such a thing as perfect security exists.
arminiusreturns 7y ago
I don't think any of them could withstand a 50k contract to breach TBH. The only ones that really could generally tend to be DoD/E related. That's not necessarily the point though, in an era of APT. I like to say breaches are inevitable, the real question is how fast do you know about it so you can mitigate/respond? HIDS/NIDS, auditing, monitoring and logging are the core of this imho.

by Veserv 7y ago

Enginerrrd 7y ago

I'd venture to guess this is almost a natural law. Look at the pathogen/organism relationship in life. A small attacker with low overhead can cripple a large complex organism. That's been evolving for billions of years without resolution. In essence, I imagine that security vs cost is an exponential curve with security being the independent variable, and cost the dependent variable. At the lowest levels, this is great because there's some very easy and cheap fixes to get large gains in security, but at the high end, each incremental gain increases in cost until it reaches beyond the realm of feasibility. Air gap all your computers? Cool, you just killed productivity which massively increased costs. Actively supervise every user? There's some niche systems that probably require this level of security, but it's rare. Even then, I don't think such a thing as perfect security exists.

arminiusreturns 7y ago

I don't think any of them could withstand a 50k contract to breach TBH. The only ones that really could generally tend to be DoD/E related. That's not necessarily the point though, in an era of APT. I like to say breaches are inevitable, the real question is how fast do you know about it so you can mitigate/respond? HIDS/NIDS, auditing, monitoring and logging are the core of this imho.