4 ms·

> I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. FAANGs are bigger targets and yet

by aj3 6y ago

> I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. FAANGs are bigger targets and yet none of them suffered anything remotely similar. > An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. That's incorrect. I already mentioned it in another reply, but in short it does not matter that attack caused 300M in damages. What matters is how much Maersk could possibly save by paying out ransom. And that's a fraction of those 300M not even including secondary effects such as potential problems with tax office, reputational damage or having to deal with becoming a target #1 for every other ransomware crew out there - as they just proved that they are ok with paying out for such "unsolicited penetration tests". It also misses that even if Maersk payed out 100M, criminals wouldn't have any way to actually benefit from all of that, as laundering such amount of BTC isn't trivial and historically that's exactly the step with highest risk for the criminals. > How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? That's a non-answerable question as it does not mention other resources that are available to attacker besides pew-pew internet weapons, restrictions that they potentially face, the risk they are comfortable with, and basically all of these questions applied to the defensive side as well (i.e. on a furthest side of the spectrum there are certain systems, attacking which would put you above ISIS leaders on a to-be-droned-soon list).

Veserv 6y ago
That is not an unanswerable question at all. To clarify, I am literally asking for a simplified threat model. Take an existing threat model, reduce it to cost of doing those actions, done. Order of magnitude is fine. If there are parameters, pick a set of parameters within the non-totally-stupid range and state them. Estimate when reasonable. The question is just me looking for broad strokes anecdotes.
- aj3 6y ago
  > To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in a week. > The question is just me looking for broad strokes anecdotes. Even Jeff Bezos wouldn't be able to orchestrate a cyberattack that crashes International Space Station with astronauts aboard.
  - Veserv 6y ago
    I do not care what parameter set you choose if you actually want to answer the question. Pick one, state the parameters, and then specify it. To illustrate: How much damage could somebody do with a $100K budget in a few months to the best system you have been personally involved in? How much damage could a well-staffed national agency do in a week to that system? For all credible adversaries that could cause $X in damage, choose the 20th percentile cost adversary, how much would that cost? The question is also specifically limited to systems the answerer has worked on to avoid speculation on practices or "grass is always greener" mentality. Did you work on the ISS on software or software security? Jeff Bezos has over $100B. Therefore, I take your answer to mean: With $100B nobody could orchestrate an cyberattack that could crash the ISS? The cost to develop the Stuxnet attack has been estimated to be $1M according to former director of the NSA General Hayden. This is likely an underestimate only accounting for the cost of the exploit itself. Kaspersky Lab claims it cost in the regime of $100M to develop and deploy. So, lets take the high number and multiple it by 10 leaving the cost of disabling the secret air-gapped Iranian Nuclear Weapons Program at $1B. Do you think the cost of a critical attack against the ISS is 100x higher than a critical attack on the Iranian Nuclear Weapons Program? Please avoid limiting your imagination to just direct attack on the ISS itself. There are multiple entities which when attacked would likely be able to de-orbit the ISS and kill all the astronauts. Please verify that none of these could occur for less than $100B: taking over a rocket to the ISS, taking over a rocket to LEO, active satellites in the correct orbital plane, decommissioned satellites that are no longer tracked but with enough fuel to intercept, scientist laptops that connect to the ISS network, over-drawing the laptop batteries so they blow up while in the ISS, etc. This also ignores more clever tactics you could do with $100B such as buy a company directly supplying critical needs of the ISS and then insert backdoors into the software.

by aj3 6y ago

Veserv 6y ago

That is not an unanswerable question at all. To clarify, I am literally asking for a simplified threat model. Take an existing threat model, reduce it to cost of doing those actions, done. Order of magnitude is fine. If there are parameters, pick a set of parameters within the non-totally-stupid range and state them. Estimate when reasonable. The question is just me looking for broad strokes anecdotes.

aj3 6y ago
> To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in a week. > The question is just me looking for broad strokes anecdotes. Even Jeff Bezos wouldn't be able to orchestrate a cyberattack that crashes International Space Station with astronauts aboard.
- Veserv 6y ago
  I do not care what parameter set you choose if you actually want to answer the question. Pick one, state the parameters, and then specify it. To illustrate: How much damage could somebody do with a $100K budget in a few months to the best system you have been personally involved in? How much damage could a well-staffed national agency do in a week to that system? For all credible adversaries that could cause $X in damage, choose the 20th percentile cost adversary, how much would that cost? The question is also specifically limited to systems the answerer has worked on to avoid speculation on practices or "grass is always greener" mentality. Did you work on the ISS on software or software security? Jeff Bezos has over $100B. Therefore, I take your answer to mean: With $100B nobody could orchestrate an cyberattack that could crash the ISS? The cost to develop the Stuxnet attack has been estimated to be $1M according to former director of the NSA General Hayden. This is likely an underestimate only accounting for the cost of the exploit itself. Kaspersky Lab claims it cost in the regime of $100M to develop and deploy. So, lets take the high number and multiple it by 10 leaving the cost of disabling the secret air-gapped Iranian Nuclear Weapons Program at $1B. Do you think the cost of a critical attack against the ISS is 100x higher than a critical attack on the Iranian Nuclear Weapons Program? Please avoid limiting your imagination to just direct attack on the ISS itself. There are multiple entities which when attacked would likely be able to de-orbit the ISS and kill all the astronauts. Please verify that none of these could occur for less than $100B: taking over a rocket to the ISS, taking over a rocket to LEO, active satellites in the correct orbital plane, decommissioned satellites that are no longer tracked but with enough fuel to intercept, scientist laptops that connect to the ISS network, over-drawing the laptop batteries so they blow up while in the ISS, etc. This also ignores more clever tactics you could do with $100B such as buy a company directly supplying critical needs of the ISS and then insert backdoors into the software.