3 ms·

>It's time to admit that computers connected to the internet can not be secured. That ship sailed a long time ago. It was normal back in the 1990s for InfoSec

>It's time to admit that computers connected to the internet can not be secured. That ship sailed a long time ago. It was normal back in the 1990s for InfoSec folk to assume that "if it's connected to the Internet, eventually, it will be compromised." The goal (then, as now) is to implement layered (defense-in-depth) mechanisms to deter such activities -- at perimeters, network and systems infrastructure platforms and software implementation. This is (and has been for a long time), a well-defined, although usually poorly (if at all) implemented set of processes and procedures. The levels of complexity for Internet resources have vastly increased over the past 25 years. Info Security techniques have advanced as well, but again are often poorly or not at all implemented. However, far too many organizations implement a "Skittles" type defensive posture rather than defense-in-depth posture. There are a variety of reasons for this: 1. Those responsible are ignorant of good security practice; 2. Those responsible are aware of the risks, but ignore it as it negatively impacts profit; 3. Those responsible are aware of the risks, but implement inadequate defenses because of the impact on time-to-market and/or profit. 4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration. There are other reasons, but those are the big ones, IMHO.

rapjr9 6y ago
True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Now APT methods are public knowledge and being used in common attacks. Some types of APT attacks are still too costly to be widely used, but some that used to be considered very sophisticated (like hiding an MCU in a computer cable) are not. The reasons you list for a weak defense posture don't really apply to a government. Also the GAO has issued a constant stream of reports saying US government agencies have poor security. It was likely only a matter of time before something like this incident happened. Similarly it's probably only a matter of time until the IRS, Social Security, and other agencies are successfully attacked on a large scale.
- nobody9999 6y ago
  >True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Perhaps I'm a little dense, but I'm not sure what you're arguing here. Are you asserting that since sophisticated threat actors exist, security processes and procedures are useless, and as such, shouldn't be adhered to or implemented?
  - rapjr9 6y ago
    No, I'm saying researchers ignored APT's for decades and now that they are available to everyone many current security processes and procedures are less effective, and yes possibly useless, _regardless_ of whether sophisticated threat actors exist (because their tools have been exposed). Current processes and procedures should still be used because they are all we have, but something new is also needed. Part of that something new should be an acknowledgement that systems are unprotectable, so instead of just security procedures we need, for example, faster recovery procedures (not just restore from backup). Another example might be dual implementations of systems, built with different technologies, so that when one is compromised the other is less likely to be susceptible to the same compromise. Expensive, but that may be what it takes to keep the world running. Splitting the internet into layers of VPN's with everything having it's own VPN might be useful too. The internet is fragmenting anyway, might as well fragment it in a useful way. Maybe everyone should have multiple physical computers as well, one for each work project, one for play, one for home finances, etc., each with tailored protections and no connections between them. I'm not sure what the answers are but it's obvious what is being done now is not good enough. I do fully expect to see the IRS hacked, chemical plants destroyed, factories stopped, etc. the way things are going now. Simple ransomware is already causing major problems and there seems to be no way to stop it and it's going to spread to all sectors and it seems likely there will be ransomware without the ransom too, just pure destruction. Already happened in Saudi Arabia.
    - nobody9999 6y ago
nautilus12 6y ago
How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for.
- nobody9999 6y ago
  >How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for. Police are credited with making arrests, but are almost never credited with treating people with respect. By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Doing the right thing for the right reasons is (or should be) a thing. That it isn't doesn't say much for those who ignore an important aspect of software design. I've always striven to meet the ideal that "if it's worth doing, it's worth doing properly." I suppose that I shouldn't hold others to the standards I set for myself, but sometimes I still do. Feel free to be offended, but I stand by my original statement: "4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration."
  - dragonwriter 6y ago
    > Police are credited with making arrests, but are almost never credited with treating people with respect. > By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. No, by their argument, to the extent your first quoted sentence is true, police are (not “should be”) encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Which seems pretty accurate.

rapjr9 6y ago

True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Now APT methods are public knowledge and being used in common attacks. Some types of APT attacks are still too costly to be widely used, but some that used to be considered very sophisticated (like hiding an MCU in a computer cable) are not. The reasons you list for a weak defense posture don't really apply to a government. Also the GAO has issued a constant stream of reports saying US government agencies have poor security. It was likely only a matter of time before something like this incident happened. Similarly it's probably only a matter of time until the IRS, Social Security, and other agencies are successfully attacked on a large scale.

nobody9999 6y ago
>True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Perhaps I'm a little dense, but I'm not sure what you're arguing here. Are you asserting that since sophisticated threat actors exist, security processes and procedures are useless, and as such, shouldn't be adhered to or implemented?
- rapjr9 6y ago
  No, I'm saying researchers ignored APT's for decades and now that they are available to everyone many current security processes and procedures are less effective, and yes possibly useless, _regardless_ of whether sophisticated threat actors exist (because their tools have been exposed). Current processes and procedures should still be used because they are all we have, but something new is also needed. Part of that something new should be an acknowledgement that systems are unprotectable, so instead of just security procedures we need, for example, faster recovery procedures (not just restore from backup). Another example might be dual implementations of systems, built with different technologies, so that when one is compromised the other is less likely to be susceptible to the same compromise. Expensive, but that may be what it takes to keep the world running. Splitting the internet into layers of VPN's with everything having it's own VPN might be useful too. The internet is fragmenting anyway, might as well fragment it in a useful way. Maybe everyone should have multiple physical computers as well, one for each work project, one for play, one for home finances, etc., each with tailored protections and no connections between them. I'm not sure what the answers are but it's obvious what is being done now is not good enough. I do fully expect to see the IRS hacked, chemical plants destroyed, factories stopped, etc. the way things are going now. Simple ransomware is already causing major problems and there seems to be no way to stop it and it's going to spread to all sectors and it seems likely there will be ransomware without the ransom too, just pure destruction. Already happened in Saudi Arabia.
  - nobody9999 6y ago

nautilus12 6y ago

How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for.

nobody9999 6y ago
>How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for. Police are credited with making arrests, but are almost never credited with treating people with respect. By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Doing the right thing for the right reasons is (or should be) a thing. That it isn't doesn't say much for those who ignore an important aspect of software design. I've always striven to meet the ideal that "if it's worth doing, it's worth doing properly." I suppose that I shouldn't hold others to the standards I set for myself, but sometimes I still do. Feel free to be offended, but I stand by my original statement: "4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration."
- dragonwriter 6y ago
  > Police are credited with making arrests, but are almost never credited with treating people with respect. > By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. No, by their argument, to the extent your first quoted sentence is true, police are (not “should be”) encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Which seems pretty accurate.