3 ms·

It's particularly in systems like these where they usually leave SSH w/ password login, or an oudated Teamviewer install. [1] Realistically, I can see this wor

It's particularly in systems like these where they usually leave SSH w/ password login, or an oudated Teamviewer install. [1] Realistically, I can see this working. For Disney. For use in action movies. In fact, "23 tons of cyber capabilities" is exactly the thing I would expect to hear from an action movie. [1]: https://www.pentestpartners.com/security-blog/pen-testing-ships-a-year-in-review/ https://www.pentestpartners.com/security-blog/pen-testing-sh...

ASalazarMX 7y ago
Everything in that website is like some action movie ad: cool black truck, acronyms, liberal use of military words, elite team, and quotes like these "See how we built this unique cyber experience – the baddest thing on wheels." "The world’s only full-scale, air-gapped cyber range that can accommodate your entire incident command staff and fusion team. Experience immersive simulations directed by an elite training force." "Learn from highly-skilled, battle-tested experts, who lead you through intense drills based on real-world attacks." I'm pumped up! (asks for prices) ...well, maybe next year.
usrusr 7y ago
Well, it's a setup for LARPing (see recent encrypted email thread) cybersecurity with execs as a flashy sales pitch, so the film prop aesthetic is the main feature. It's literally a roadshow. I'm just a bit disappointed that the trailer can't deploy an autonomous Tesla Cybertruck manned by David Hasselhoff.
- aneutron 7y ago
  While I do agree with you on the IBM truck remarks, I find myself heavily disagreeing with the "PGP / SMTP over TLS" is LARPing" gentleman. For one, he makes the argument that it's all a theater. Is it broken ? Yes. Does it provide some non-negligeable level of confidentiality ? Absolutely. Is it "broken" in some way or another ? Yes. But that doesn't mean we should just fall back to regular plain unencrypted email when PGP MAKES MORE SENSE. I myself don't use PGP when it doesn't really make sense. But when sending a security vulnerability, I'd say it's pretty safe to assume you're not LARPing at that point. Sure, maybe they know you're sending a PoC. But that will at least delay them for a couple of days (or hours if you're a high value target). A comment on that thread expressed exactly what I feel and what I assume what most of security minded people feel: Sure, it is not perfect. But if I want perfect-secrect (as perfect as it theoretically gets anyway), I'm going to use Signal. But when your company has e-mail as the main communication form, it doesn't make much sense to use another form of communication, it will hinder productivity and obstruct your company's processes. All in all, LARPing is a strong word. If anything, we should applaud the effort confidentiality-minded people put up, and push for better protocols.
  - iudqnolq 7y ago
    You're probably aware, but the obvious counterargument people make to what you've said is that for some people such as activists under repressive regimes they would rather not be able to email than email under the mistaken belief what they were sending is highly secure. TFA on that article said the risk is non-technical users seeing technical users use PGP and assuming it's a good option when there are high stakes.
    - aneutron 7y ago
      I hadn't thought about that possibility. But I think it's arguably more of a cultural and informational, rather than a technical thing. But I do agree that when the stakes are high, mistakes like these can mean life or death. But again, that can be solved by trying to better the general understanding of confidential communication systems.
      - iudqnolq 7y ago
        I agree with most of that, which is why I think LARPing is a fair metaphor. It succinctly gets across that this is a cool thing for techies but not for general usage when it's safety critical.

ASalazarMX 7y ago

Everything in that website is like some action movie ad: cool black truck, acronyms, liberal use of military words, elite team, and quotes like these "See how we built this unique cyber experience – the baddest thing on wheels." "The world’s only full-scale, air-gapped cyber range that can accommodate your entire incident command staff and fusion team. Experience immersive simulations directed by an elite training force." "Learn from highly-skilled, battle-tested experts, who lead you through intense drills based on real-world attacks." I'm pumped up! (asks for prices) ...well, maybe next year.

usrusr 7y ago

Well, it's a setup for LARPing (see recent encrypted email thread) cybersecurity with execs as a flashy sales pitch, so the film prop aesthetic is the main feature. It's literally a roadshow. I'm just a bit disappointed that the trailer can't deploy an autonomous Tesla Cybertruck manned by David Hasselhoff.

aneutron 7y ago
While I do agree with you on the IBM truck remarks, I find myself heavily disagreeing with the "PGP / SMTP over TLS" is LARPing" gentleman. For one, he makes the argument that it's all a theater. Is it broken ? Yes. Does it provide some non-negligeable level of confidentiality ? Absolutely. Is it "broken" in some way or another ? Yes. But that doesn't mean we should just fall back to regular plain unencrypted email when PGP MAKES MORE SENSE. I myself don't use PGP when it doesn't really make sense. But when sending a security vulnerability, I'd say it's pretty safe to assume you're not LARPing at that point. Sure, maybe they know you're sending a PoC. But that will at least delay them for a couple of days (or hours if you're a high value target). A comment on that thread expressed exactly what I feel and what I assume what most of security minded people feel: Sure, it is not perfect. But if I want perfect-secrect (as perfect as it theoretically gets anyway), I'm going to use Signal. But when your company has e-mail as the main communication form, it doesn't make much sense to use another form of communication, it will hinder productivity and obstruct your company's processes. All in all, LARPing is a strong word. If anything, we should applaud the effort confidentiality-minded people put up, and push for better protocols.
- iudqnolq 7y ago
  You're probably aware, but the obvious counterargument people make to what you've said is that for some people such as activists under repressive regimes they would rather not be able to email than email under the mistaken belief what they were sending is highly secure. TFA on that article said the risk is non-technical users seeing technical users use PGP and assuming it's a good option when there are high stakes.
  - aneutron 7y ago
    I hadn't thought about that possibility. But I think it's arguably more of a cultural and informational, rather than a technical thing. But I do agree that when the stakes are high, mistakes like these can mean life or death. But again, that can be solved by trying to better the general understanding of confidential communication systems.
    - iudqnolq 7y ago
      I agree with most of that, which is why I think LARPing is a fair metaphor. It succinctly gets across that this is a cool thing for techies but not for general usage when it's safety critical.