4 ms·

> It’s sad that it’s come to this point but the end result may be better for everyone. Meanwhile in the real world, a company I develop for implemented the mos

> It’s sad that it’s come to this point but the end result may be better for everyone. Meanwhile in the real world, a company I develop for implemented the most draconian security measures to "prevent ransomware". Development environment is a virtual machine at the other end of the world, with disabled copy-pasting from and to the local system. A complete separation between safe internal network and unsafe development environment. No copy pasting from and to email, etc. Horrible environment to work in.

tiew9Vii 6y ago
Had one of these. All development through Citrix. The security policy was draconian to the extent I’m sure it was well intentioned but led you to do things in the least secure way possible as it was the only way to complete a contract. I.e the servers on the other end running Windows 7 (in late 2019) where so old they didn’t have the required cpu instruction set to run some required software. Likewise input lag was extremely noticeable to the point you hit a key, wait one second then press again thinking something went wrong only to have to press delete some seconds later. How did I deliver that project? Developed on my own local machine, emailed the artifact to the cooperate email address obfuscated, log in to the corporate laptop, then Citrix, ssh the artifact up to the cloud ec2 servers. That’s another one. The cloud ec2 servers. No public outbound internet, no internal trusted repositories. What was the accepted way of setting up the servers? Going to random internet sites, downloading random binaries to your Citrix account, scp’ing then to the servers. Trying to explain how stupid this is gets no where in organisations with thousands of people. When you mention trusted artifact repositories, immutable / reproducible builds, deployment pipelines the answer was we don’t have this as they didn’t meet security guidelines. This was a tier 1 bank. Experience is the bigger the company the worse things are due to the size and different teams/departments being so disconnected.
- awakeasleep 6y ago
  The organization has externalized all the responsibility for the next breach to you, the individual contributor who is breaking security protocol to get work done. When we little employees roll our eyes and say "this doesn't make sense," we're telling ourselves a comforting lie because the situation you describe DOES make sense- from the organizational perspective. Management did everything their rules allow to make the computing environment safe, but you, the individual, hacked an unsafe circumvention into the workflow by finagling some personal website and using SCP. I bet none of that process is documented- and if it is, whoever made that documentation is now the responsible party and fall guy.
  - mint2 6y ago
    Get email approval, aka written documentation, of all process steps from people one step up on the food chain. Explain why it’s needed so they are squarely the section maker.
- buran77 6y ago
  > The security policy was draconian The setup you describe sounds less like draconian security and more like a half baked solution that confused usability hurdles for security. Just because security usually brings lower usability, it was probably (wrongly!) assumed that lowering usability will bring security.
- user5994461 6y ago
  Counterpoint at another Tier 1 bank. The bank was using remote desktops over Citrix from HP workstations (thin clients). It worked really really well, including copy/paste. If not for the initial login and citrix log, I don't think it would be possible for a developer to figure out he is working on a remote desktop.
wffurr 6y ago
How do top tier tech companies, who are very likely continuous targets for this kind of thing, avoid ransomware attacks? I know there's nothing like that at my employer.
- formercoder 6y ago
  The basics go a long way: two factor auth and privilege minimization.
- staticassertion 6y ago
  There are two big things you want to do: 1) App whitelisting. This is not the strongest mitigation (attackers with exploits can move in memory), but it stops drive-bys and 99% of malware, plus it massively reduces noise on the network. 2) Reduce lateral movement. If the attacker accesses an employee laptop, encrypts it, but can't move to other devices, that's not a very compelling ransom.
  - mox1 6y ago
    As someone who runs a Banks internal Red Team group, the App Whitelisting is the biggest roadblock for us. Carbon Black (if properly setup and tuned) is a large leap to overcome. Drive-by attacks just stop, you need a dedicated method to bypass Carbon Black. That is usually very org dependent. You don't known Carbon Black is there until something doesn't work. That "not working" propagates an alert up to the security team.
    - staticassertion 6y ago
      App whitelisting is rarely rolled out, but it's just such a definitive win these days. a) You just kill ~85% of malware (rough estimate, probably technically higher, but I'm basing that on stats around interpreter-based/LOLBAS malware). Anything that isn't targeted is probably dead in the water. b) You know exactly what's running on everyone's computers, more or less, so you have a way easier time baselining and building monitoring. It's honestly easy-mode for security. But it's hard to roll out to a company a decade after it's been running, so you really need to do it early on. And most orgs don't care about security until after a breach, at which point they're too large and slow to get something like that done.
Cantbekhan 6y ago
Can't you just still do a screenshot/screen recording and use OTR on it? Or just use a keylogger for logging what you typed (and just use keylogger to retype it)?

tiew9Vii 6y ago

Had one of these. All development through Citrix. The security policy was draconian to the extent I’m sure it was well intentioned but led you to do things in the least secure way possible as it was the only way to complete a contract. I.e the servers on the other end running Windows 7 (in late 2019) where so old they didn’t have the required cpu instruction set to run some required software. Likewise input lag was extremely noticeable to the point you hit a key, wait one second then press again thinking something went wrong only to have to press delete some seconds later. How did I deliver that project? Developed on my own local machine, emailed the artifact to the cooperate email address obfuscated, log in to the corporate laptop, then Citrix, ssh the artifact up to the cloud ec2 servers. That’s another one. The cloud ec2 servers. No public outbound internet, no internal trusted repositories. What was the accepted way of setting up the servers? Going to random internet sites, downloading random binaries to your Citrix account, scp’ing then to the servers. Trying to explain how stupid this is gets no where in organisations with thousands of people. When you mention trusted artifact repositories, immutable / reproducible builds, deployment pipelines the answer was we don’t have this as they didn’t meet security guidelines. This was a tier 1 bank. Experience is the bigger the company the worse things are due to the size and different teams/departments being so disconnected.

awakeasleep 6y ago
The organization has externalized all the responsibility for the next breach to you, the individual contributor who is breaking security protocol to get work done. When we little employees roll our eyes and say "this doesn't make sense," we're telling ourselves a comforting lie because the situation you describe DOES make sense- from the organizational perspective. Management did everything their rules allow to make the computing environment safe, but you, the individual, hacked an unsafe circumvention into the workflow by finagling some personal website and using SCP. I bet none of that process is documented- and if it is, whoever made that documentation is now the responsible party and fall guy.
- mint2 6y ago
  Get email approval, aka written documentation, of all process steps from people one step up on the food chain. Explain why it’s needed so they are squarely the section maker.
buran77 6y ago
> The security policy was draconian The setup you describe sounds less like draconian security and more like a half baked solution that confused usability hurdles for security. Just because security usually brings lower usability, it was probably (wrongly!) assumed that lowering usability will bring security.
user5994461 6y ago
Counterpoint at another Tier 1 bank. The bank was using remote desktops over Citrix from HP workstations (thin clients). It worked really really well, including copy/paste. If not for the initial login and citrix log, I don't think it would be possible for a developer to figure out he is working on a remote desktop.

wffurr 6y ago

How do top tier tech companies, who are very likely continuous targets for this kind of thing, avoid ransomware attacks? I know there's nothing like that at my employer.

formercoder 6y ago
The basics go a long way: two factor auth and privilege minimization.
staticassertion 6y ago
There are two big things you want to do: 1) App whitelisting. This is not the strongest mitigation (attackers with exploits can move in memory), but it stops drive-bys and 99% of malware, plus it massively reduces noise on the network. 2) Reduce lateral movement. If the attacker accesses an employee laptop, encrypts it, but can't move to other devices, that's not a very compelling ransom.
- mox1 6y ago
  As someone who runs a Banks internal Red Team group, the App Whitelisting is the biggest roadblock for us. Carbon Black (if properly setup and tuned) is a large leap to overcome. Drive-by attacks just stop, you need a dedicated method to bypass Carbon Black. That is usually very org dependent. You don't known Carbon Black is there until something doesn't work. That "not working" propagates an alert up to the security team.
  - staticassertion 6y ago
    App whitelisting is rarely rolled out, but it's just such a definitive win these days. a) You just kill ~85% of malware (rough estimate, probably technically higher, but I'm basing that on stats around interpreter-based/LOLBAS malware). Anything that isn't targeted is probably dead in the water. b) You know exactly what's running on everyone's computers, more or less, so you have a way easier time baselining and building monitoring. It's honestly easy-mode for security. But it's hard to roll out to a company a decade after it's been running, so you really need to do it early on. And most orgs don't care about security until after a breach, at which point they're too large and slow to get something like that done.

Cantbekhan 6y ago

Can't you just still do a screenshot/screen recording and use OTR on it? Or just use a keylogger for logging what you typed (and just use keylogger to retype it)?