7 ms·

The real takeaway from this: Do your threat models include your staff? Of course, nobody has admin access. Do your threat models include your staff access

The real takeaway from this: Do your threat models include your staff? Of course, nobody has admin access. Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? IME this is a great interview question to ask potential employers. The rabbit hole that you are required to go down will open eyes. The answer is: you can't. But how you mitigate damage (with data silos) and engage in disaster recovery after the fact puts you in excellent condition to weather any storm.

dec0dedab0de 6y ago
Every time a friend or relative asks my opinion on some tech that involves cameras or microphones I always point this out. Usually by asking How comfortable do you feel with a bored admin watching you? How well do you think the company is monitoring it?
munchbunny 6y ago
Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? That's precisely the hard question, but I think you can reframe that question: "How can you tell when somebody is accessing data that isn't necessary to do their job, in a given specific case?" For example, could you correlate access logs to support tickets to make sure a support agent was only accessing sensitive data corresponding to the customer whose ticket they were working on? Could you do that in a mostly transparent way? What if the customer has to explicitly grant access before the agent can open the account for investigation? (None of these ideas are silver bullets, they're all situational possibilities.) I don't think there are any easy answers, but I do think there's some granularity to how hard any given company finds it reasonable to try to guard against this issue at a behavioral level.
- eternalban 6y ago
  This may be a killer app for capability (security) model' approach. The "bored admin" of another comment in this thread has a 'superuser' ACL grant, and would leave auditable traces [if using] a provisionally granted security capability.
  - x86_64Ubuntu 6y ago
    I worked on a HIPAA application years and years ago. I don't think ANYONE was above having their access logged. I'm sure banks have also solved this problem too of no-unauditable access.
    - meowface 6y ago
      Of course. But the question is if a smart, malicious, dedicated insider with a lot of privileges could find some way to access information while evading logging and covering their tracks in other ways.
      - munchbunny 6y ago
        The answer is definitely yes. Though I feel obligated to add that I think the above fact doesn’t mean an organization shouldn’t try at all to protect against insider threat. Most are opportunistic, not all of the qualities you mentioned. How hard you try depends on your company’s situation. Some industries make it more necessary than others.
eterm 6y ago
Treat it like financial or banking fraud. You can't stop someone taking it, but you can audit the hell out of it so when stuff gets misappropriated you can find out exactly who was responsible. Then the law becomes the deterrent.
- rndgermandude 6y ago
  The problem with this is that first somebody has to notice. In banking the reports will flow in quickly if somebody lost money. In Roblox, when somebody created in-game currency out of thin air or accesses private information of other people, then chances are nobody notices and the audit logs are never manually investigated. Doing automated audits then again brings up the question: how do you determine if something was the result of a genuine support action or fraudulent. You can try to find/train algorithms to detect that, but given that you can only train it against common fraudulent patterns, and do not know about unreported cases by the very definition, you cannot be sure such a system is operating well and/or cannot be easily gamed. Banks have it easier in that regard, because the books have to match end of the day. The law being the deterrent didn't really help here either. According to the article the "hacker" either bribed somebody for access, phished somebody for access or used some vulnerability to gain access. All of which isn't exactly legal, so the deterrent already did not work, tho it might make your own employees think twice about accepting bribes. But the hacker probably will not care about your audit system beyond the point of defeating it long enough to gain whatever they were out to gain.
  - deleted 6y ago
    [deleted]
- mulmen 6y ago
  Right because there's no fraud in the financial sector. The last time my debit card got stolen the fraud people at my credit union suggested checking my account daily to catch it as soon as it happens again. They didn't really even expect to be able to prevent it. Or pretend like they would try. It's apparently my responsibility to make sure they didn't just hand out some of my money to whoever walked by and asked for it. They never know exactly who was responsible because they were responsible. Of course the law doesn't see it that way.
volume 6y ago
On top of that, how much do your personal threat models overlap with your boss's or the executive staff? How much do they trust your judgement/expertise? How well do you demonstrate judgement/expertise? If you are the executive staff, fantastic - one less thing to worry about.
umvi 6y ago
This is why security is an onerous black hole. Security folks always condescendingly lambaste companies not using best practices, but security is literally the worst. It's an infinitely deep hole of money, time, and CPU cycles. If you create a startup with security best practices you'll never get anything done because you have to build everything in a way such that you don't trust anyone, including your own staff. So now your staff have ball and chains shackled to their ankles to prevent them from misbehaving (but also preventing them from having agility). It's 100x cheaper and easier to do the cheapest 80% of security, and then hope that you don't get exploited by the other 20%.
- mox1 6y ago
  You say black hole, us security people call it a "hard problem". I mean lots of IT things are or end up being black holes. I will say though, usually, attitudes like yours end up causing more problems than they solve (casual dismissal of security in general, more of a bother, doesn't stop everyone, waste of time, etc. etc.) I like to think of security like this: My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. Yes, black hole, but my (infinite) glass is half-full.
  - umvi 6y ago
    The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff. Yes, I get we live in a world where bad people take advantage of others, making security necessary. But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist. > My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.
kbenson 6y ago
> IME this is a great interview question to ask potential employers. That also sounds like an easy way to immediately exclude yourself and cut the interview short. It's sort of like interviewing someone for a security position, and them asking "by the way, what brand of locks and safes do you use, and what's your alarm company and specs?" It's not hard to see how it could be taken the wrong way, and giving information about internal security procedures (even generalities) to someone not contractually obligated to the company in some way doesn't seem a good idea to me.
- grawprog 6y ago
  We had a guy like that at my old job. He immediately made everyone suspicious. His first day, he constantly asked about security cameras, which doors were locked at night, how valuable everything was etc. He was frequently found in weird places with no explanation, seemed uninterested in anything about his actual job or even beginning to learn why he was there or what his tasks would be, and just generally gave off the vibe of 'was planning some oceans 11 shit' or something. He seemed oblivious to exactly how odd and suspicious he was being. He only lasted a few days, I'm honestly not sure why the boss kept him around that long. Nobody was impressed. I guess my point is, if your genuine concern is security, definitely make sure you're not coming off like you're planning some grand movie heist. He was probably one of the oddest people i've worked with, turns out nobody checked his out of province reference and when they finally did, nobody'd ever actually heard of him at his 'previous place of employment' so who knows.
  - codezero 6y ago
    Hilarious - I worked with someone in the past that was very similar. They lasted a few weeks. We ignored some yellow/red flags when hiring, so it's our own fault.
    - grawprog 6y ago
      Yeah we were short staffed at the time. I don't think they were paying that much attention as long as someone seemed to check out at first glance. We want through a bunch of people that didn't last long around that time. He was probably the most memorable though.
scotty79 6y ago
On some cryptography lecture I heard that definition of a trusted party is a person that could betray your trust and expose your secrets.
lnanek2 6y ago
You are missing some techniques there. For example, to access any production user data where I work, I have to fill out a lease form and someone has to approve it. So you can technically have no one with admin access on their own without documentation and oversight.
user5994461 6y ago
>>> The answer is: you can't. Yes you can and it's almost trivial to do. Require an active ticket to access stuff, that needs approval from a second person. For very sensitive matters (say doing large transfers in a finance/bitcoin company), make it three or more people.

dec0dedab0de 6y ago

Every time a friend or relative asks my opinion on some tech that involves cameras or microphones I always point this out. Usually by asking How comfortable do you feel with a bored admin watching you? How well do you think the company is monitoring it?

munchbunny 6y ago

Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? That's precisely the hard question, but I think you can reframe that question: "How can you tell when somebody is accessing data that isn't necessary to do their job, in a given specific case?" For example, could you correlate access logs to support tickets to make sure a support agent was only accessing sensitive data corresponding to the customer whose ticket they were working on? Could you do that in a mostly transparent way? What if the customer has to explicitly grant access before the agent can open the account for investigation? (None of these ideas are silver bullets, they're all situational possibilities.) I don't think there are any easy answers, but I do think there's some granularity to how hard any given company finds it reasonable to try to guard against this issue at a behavioral level.

eternalban 6y ago
This may be a killer app for capability (security) model' approach. The "bored admin" of another comment in this thread has a 'superuser' ACL grant, and would leave auditable traces [if using] a provisionally granted security capability.
- x86_64Ubuntu 6y ago
  I worked on a HIPAA application years and years ago. I don't think ANYONE was above having their access logged. I'm sure banks have also solved this problem too of no-unauditable access.
  - meowface 6y ago
    Of course. But the question is if a smart, malicious, dedicated insider with a lot of privileges could find some way to access information while evading logging and covering their tracks in other ways.
    - munchbunny 6y ago
      The answer is definitely yes. Though I feel obligated to add that I think the above fact doesn’t mean an organization shouldn’t try at all to protect against insider threat. Most are opportunistic, not all of the qualities you mentioned. How hard you try depends on your company’s situation. Some industries make it more necessary than others.

eterm 6y ago

Treat it like financial or banking fraud. You can't stop someone taking it, but you can audit the hell out of it so when stuff gets misappropriated you can find out exactly who was responsible. Then the law becomes the deterrent.

rndgermandude 6y ago
The problem with this is that first somebody has to notice. In banking the reports will flow in quickly if somebody lost money. In Roblox, when somebody created in-game currency out of thin air or accesses private information of other people, then chances are nobody notices and the audit logs are never manually investigated. Doing automated audits then again brings up the question: how do you determine if something was the result of a genuine support action or fraudulent. You can try to find/train algorithms to detect that, but given that you can only train it against common fraudulent patterns, and do not know about unreported cases by the very definition, you cannot be sure such a system is operating well and/or cannot be easily gamed. Banks have it easier in that regard, because the books have to match end of the day. The law being the deterrent didn't really help here either. According to the article the "hacker" either bribed somebody for access, phished somebody for access or used some vulnerability to gain access. All of which isn't exactly legal, so the deterrent already did not work, tho it might make your own employees think twice about accepting bribes. But the hacker probably will not care about your audit system beyond the point of defeating it long enough to gain whatever they were out to gain.
- deleted 6y ago
  [deleted]
mulmen 6y ago
Right because there's no fraud in the financial sector. The last time my debit card got stolen the fraud people at my credit union suggested checking my account daily to catch it as soon as it happens again. They didn't really even expect to be able to prevent it. Or pretend like they would try. It's apparently my responsibility to make sure they didn't just hand out some of my money to whoever walked by and asked for it. They never know exactly who was responsible because they were responsible. Of course the law doesn't see it that way.

volume 6y ago

On top of that, how much do your personal threat models overlap with your boss's or the executive staff? How much do they trust your judgement/expertise? How well do you demonstrate judgement/expertise? If you are the executive staff, fantastic - one less thing to worry about.

umvi 6y ago

This is why security is an onerous black hole. Security folks always condescendingly lambaste companies not using best practices, but security is literally the worst. It's an infinitely deep hole of money, time, and CPU cycles. If you create a startup with security best practices you'll never get anything done because you have to build everything in a way such that you don't trust anyone, including your own staff. So now your staff have ball and chains shackled to their ankles to prevent them from misbehaving (but also preventing them from having agility). It's 100x cheaper and easier to do the cheapest 80% of security, and then hope that you don't get exploited by the other 20%.

mox1 6y ago
You say black hole, us security people call it a "hard problem". I mean lots of IT things are or end up being black holes. I will say though, usually, attitudes like yours end up causing more problems than they solve (casual dismissal of security in general, more of a bother, doesn't stop everyone, waste of time, etc. etc.) I like to think of security like this: My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. Yes, black hole, but my (infinite) glass is half-full.
- umvi 6y ago
  The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff. Yes, I get we live in a world where bad people take advantage of others, making security necessary. But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist. > My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.

kbenson 6y ago

> IME this is a great interview question to ask potential employers. That also sounds like an easy way to immediately exclude yourself and cut the interview short. It's sort of like interviewing someone for a security position, and them asking "by the way, what brand of locks and safes do you use, and what's your alarm company and specs?" It's not hard to see how it could be taken the wrong way, and giving information about internal security procedures (even generalities) to someone not contractually obligated to the company in some way doesn't seem a good idea to me.

grawprog 6y ago
We had a guy like that at my old job. He immediately made everyone suspicious. His first day, he constantly asked about security cameras, which doors were locked at night, how valuable everything was etc. He was frequently found in weird places with no explanation, seemed uninterested in anything about his actual job or even beginning to learn why he was there or what his tasks would be, and just generally gave off the vibe of 'was planning some oceans 11 shit' or something. He seemed oblivious to exactly how odd and suspicious he was being. He only lasted a few days, I'm honestly not sure why the boss kept him around that long. Nobody was impressed. I guess my point is, if your genuine concern is security, definitely make sure you're not coming off like you're planning some grand movie heist. He was probably one of the oddest people i've worked with, turns out nobody checked his out of province reference and when they finally did, nobody'd ever actually heard of him at his 'previous place of employment' so who knows.
- codezero 6y ago
  Hilarious - I worked with someone in the past that was very similar. They lasted a few weeks. We ignored some yellow/red flags when hiring, so it's our own fault.
  - grawprog 6y ago
    Yeah we were short staffed at the time. I don't think they were paying that much attention as long as someone seemed to check out at first glance. We want through a bunch of people that didn't last long around that time. He was probably the most memorable though.

scotty79 6y ago

On some cryptography lecture I heard that definition of a trusted party is a person that could betray your trust and expose your secrets.

lnanek2 6y ago

You are missing some techniques there. For example, to access any production user data where I work, I have to fill out a lease form and someone has to approve it. So you can technically have no one with admin access on their own without documentation and oversight.

user5994461 6y ago

>>> The answer is: you can't. Yes you can and it's almost trivial to do. Require an active ticket to access stuff, that needs approval from a second person. For very sensitive matters (say doing large transfers in a finance/bitcoin company), make it three or more people.