4 ms·

> For rack-mounted servers, I've seen things like the entire motherboard and hard drive submerged in 5 kg of heat-conductive epoxy resin so that it's nearly imp

by franga2000 6y ago

> For rack-mounted servers, I've seen things like the entire motherboard and hard drive submerged in 5 kg of heat-conductive epoxy resin so that it's nearly impossible to remove the RAM sticks or hard drive without destroying them. I find it absolutely hilarious that there are some organisations going to such lengths to protect their data but other organisations with just as sensitive data keep it in unpatched datastores and leaky S3 buckets...

howlgarnish 6y ago
Having worked with some financial institutions, I can assure you it's often the same orgs that spend bazillions on extra-super-secure hardware etc and then leave security holes large enough to drive trucks through elsewhere. In short, if you make the process to do things the Right Way hard enough, people will just circumvent the process.
- qz2 6y ago
  It's even worse than that from experience. Most of these financial institutions had terrible practices before and the surface area of their terrible practices is huge and mostly unknown. So when they go and apply some new super secure process or audit they don't actually apply it across their entire estate or the organisation is so thoroughly compartmentalised that it's impossible to get everyone to align with the goals of the audit. The only outcome is what they call a partial success but I call a complete failure.
- jtwaleson 6y ago
  That wording is brilliant. I struggle with this a lot in a regulated industry. Everyone wants to do The Right Thing, but doing it "The Right Way" and documenting accordingly is so much work!
  - 542354234235 6y ago
    Also, the people in charge just putting all the onus on individual operators. That they will jump through all those hoops because it is “the right way” so of course they will do it. Well, news flash. A lot of people don’t and if you have a security breach, its cold comfort that it was because someone took a shortcut on step 438 of your pointlessly difficult process. Imagine if airline safety operated that way. “Well, it is up to the pilot to make sure they pay attention and keep up with their training. They will do it because it is the right way.” No, they look at how can they make it impossible to do the wrong thing. How can they make this alarm impossible to ignore? In this very specific scenario, is it possible for this problem to go unnoticed or undetected? How can we train pilots and ensure they understand in a real world situation? Etc. Which is the right model, in my opinion. It isn’t “on paper, does this technically solve the problem” it is “regardless of user error or equipment failure, will this still solve the problem”.
- whazor 6y ago
  Which makes sense, you have big security teams with the job to do security stuff. Then you have software and business teams who trying to meet certain targets, where security is normally an afterthought.
toyg 6y ago
It's even more hilarious that there is typically a disconnect between hardware and software management, so that you could have one dept buying this sort of war-resistant servers and then handing them off to a different, averagely-incompetent dept who will use them to run ancient exploit-ridden software with default passwords.
cblconfederate 6y ago
could be the same organization
vbezhenar 6y ago
They are not going to such lengths to protect their data. They are going to such lengths to conform to regulations. Other organizations don't need to conform to regulations, so they put a fair price for their security (you might not agree with that price, of course).
doublerabbit 6y ago
I've worked for one of those companies. The root password was @R00t#

howlgarnish 6y ago

Having worked with some financial institutions, I can assure you it's often the same orgs that spend bazillions on extra-super-secure hardware etc and then leave security holes large enough to drive trucks through elsewhere. In short, if you make the process to do things the Right Way hard enough, people will just circumvent the process.

qz2 6y ago
It's even worse than that from experience. Most of these financial institutions had terrible practices before and the surface area of their terrible practices is huge and mostly unknown. So when they go and apply some new super secure process or audit they don't actually apply it across their entire estate or the organisation is so thoroughly compartmentalised that it's impossible to get everyone to align with the goals of the audit. The only outcome is what they call a partial success but I call a complete failure.
jtwaleson 6y ago
That wording is brilliant. I struggle with this a lot in a regulated industry. Everyone wants to do The Right Thing, but doing it "The Right Way" and documenting accordingly is so much work!
- 542354234235 6y ago
  Also, the people in charge just putting all the onus on individual operators. That they will jump through all those hoops because it is “the right way” so of course they will do it. Well, news flash. A lot of people don’t and if you have a security breach, its cold comfort that it was because someone took a shortcut on step 438 of your pointlessly difficult process. Imagine if airline safety operated that way. “Well, it is up to the pilot to make sure they pay attention and keep up with their training. They will do it because it is the right way.” No, they look at how can they make it impossible to do the wrong thing. How can they make this alarm impossible to ignore? In this very specific scenario, is it possible for this problem to go unnoticed or undetected? How can we train pilots and ensure they understand in a real world situation? Etc. Which is the right model, in my opinion. It isn’t “on paper, does this technically solve the problem” it is “regardless of user error or equipment failure, will this still solve the problem”.
whazor 6y ago
Which makes sense, you have big security teams with the job to do security stuff. Then you have software and business teams who trying to meet certain targets, where security is normally an afterthought.

toyg 6y ago

It's even more hilarious that there is typically a disconnect between hardware and software management, so that you could have one dept buying this sort of war-resistant servers and then handing them off to a different, averagely-incompetent dept who will use them to run ancient exploit-ridden software with default passwords.

cblconfederate 6y ago

could be the same organization

vbezhenar 6y ago

They are not going to such lengths to protect their data. They are going to such lengths to conform to regulations. Other organizations don't need to conform to regulations, so they put a fair price for their security (you might not agree with that price, of course).

doublerabbit 6y ago

I've worked for one of those companies. The root password was @R00t#