3 ms·

FUD

by Xurinos 16y ago

FUD

tectonic 16y ago
Explain.
- stcredzero 16y ago
  I've worked on the software of a lot of big energy companies. A lot of those companies can make tons of money just because they are huge and have deals going on everywhere. This gives them a lot of information about what's going on in energy markets all around the world. In short, this information is highly valuable, and yet it often flies around corporate networks in plaintext. Just undetectably getting this information to an outside party would be a highly illegal act that would enable a great many other profitable and highly illegal acts. (And it would also be very hard to do this without getting caught. Even harder than most people would think. Particularly at the point where you're trying to make money.)
  - trotsky 16y ago
    Night Dragon: http://www.bloomberg.com/news/2011-02-24/exxon-shell-bp-said-to-have-been-hacked-through-chinese-internet-servers.html http://www.bloomberg.com/news/2011-02-24/exxon-shell-bp-said... This is a serious APT that's been ongoing for 4-5 years and benefits chinese oil exploration.
    - stcredzero 16y ago
      Having foreign governments cover for you is one way of getting away with stuff like that. When I was working at Shell, I would never have imagined such a thing was possible for someone like me to arrange -- that would only be the stuff of movies and books. Now, in this very globally connected age, such things are no longer so far out. I still wouldn't touch that with a 10 foot pole. Even with China covering for you, it's not a game to play lightly for anyone who has a home and life in the US.
    - caudipublius 16y ago
      wait, why are Greg Hoglund and HBGary still 'reputable' sources linked and quoted from in this article written 4 days ago?
      - trotsky 16y ago
        A significant amount of the source material about Night Dragon came from the same email theft that outed the wikileaks and CoC issues. Since it sounds like you believe the latter, why would you say the former isn't credible?
- bradleyland 16y ago
  Probably because there's nothing new here. Controlling physical access to a network is a long standing problem with a wide variety of solutions. As with any security technology, these solutions are imperfect, but the plug computer only brings a couple new factors to the table: it doesn't look like a computer and it is extremely small, so it's very concealable. Neither of these contribute significantly to your exposure any more than something like a laptop or netbook. Concealment helps protect against casual detection, but many offices are littered with spare laptops that no one pays any attention to any way. This is especially true in IT departments where systems may sit on shelves for days or weeks waiting for repair. The notion that a plug computer may be hard to find once identified sounds scary, but in practice, it's a non-issue. You simply identify the port to which the device is connected, unplug it, then trace the cable back to its termination point. I'm going to ignore wireless, because no sensible security plan involves a WiFi network attached to their private network. You segregate wireless in the DMZ, then allow WiFi users to connect to a VPN endpoint using strong encryption. Any business concerned about securing their networks has implemented policies like shutting interfaces that aren't in use, and authenticating access at the Ethernet level using 802.1X. Neither of these are foolproof, but depending upon how secure you want to be, you build up security at every layer: physical, Ethernet, VPN, application.

FUD

by Xurinos 16y ago

FUD

tectonic 16y ago

Explain.

stcredzero 16y ago
I've worked on the software of a lot of big energy companies. A lot of those companies can make tons of money just because they are huge and have deals going on everywhere. This gives them a lot of information about what's going on in energy markets all around the world. In short, this information is highly valuable, and yet it often flies around corporate networks in plaintext. Just undetectably getting this information to an outside party would be a highly illegal act that would enable a great many other profitable and highly illegal acts. (And it would also be very hard to do this without getting caught. Even harder than most people would think. Particularly at the point where you're trying to make money.)
- trotsky 16y ago
  Night Dragon: http://www.bloomberg.com/news/2011-02-24/exxon-shell-bp-said-to-have-been-hacked-through-chinese-internet-servers.html http://www.bloomberg.com/news/2011-02-24/exxon-shell-bp-said... This is a serious APT that's been ongoing for 4-5 years and benefits chinese oil exploration.
  - stcredzero 16y ago
    Having foreign governments cover for you is one way of getting away with stuff like that. When I was working at Shell, I would never have imagined such a thing was possible for someone like me to arrange -- that would only be the stuff of movies and books. Now, in this very globally connected age, such things are no longer so far out. I still wouldn't touch that with a 10 foot pole. Even with China covering for you, it's not a game to play lightly for anyone who has a home and life in the US.
  - caudipublius 16y ago
    wait, why are Greg Hoglund and HBGary still 'reputable' sources linked and quoted from in this article written 4 days ago?
    - trotsky 16y ago
      A significant amount of the source material about Night Dragon came from the same email theft that outed the wikileaks and CoC issues. Since it sounds like you believe the latter, why would you say the former isn't credible?
bradleyland 16y ago
Probably because there's nothing new here. Controlling physical access to a network is a long standing problem with a wide variety of solutions. As with any security technology, these solutions are imperfect, but the plug computer only brings a couple new factors to the table: it doesn't look like a computer and it is extremely small, so it's very concealable. Neither of these contribute significantly to your exposure any more than something like a laptop or netbook. Concealment helps protect against casual detection, but many offices are littered with spare laptops that no one pays any attention to any way. This is especially true in IT departments where systems may sit on shelves for days or weeks waiting for repair. The notion that a plug computer may be hard to find once identified sounds scary, but in practice, it's a non-issue. You simply identify the port to which the device is connected, unplug it, then trace the cable back to its termination point. I'm going to ignore wireless, because no sensible security plan involves a WiFi network attached to their private network. You segregate wireless in the DMZ, then allow WiFi users to connect to a VPN endpoint using strong encryption. Any business concerned about securing their networks has implemented policies like shutting interfaces that aren't in use, and authenticating access at the Ethernet level using 802.1X. Neither of these are foolproof, but depending upon how secure you want to be, you build up security at every layer: physical, Ethernet, VPN, application.