3 ms·

True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to s

by rapjr9 6y ago

True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Now APT methods are public knowledge and being used in common attacks. Some types of APT attacks are still too costly to be widely used, but some that used to be considered very sophisticated (like hiding an MCU in a computer cable) are not. The reasons you list for a weak defense posture don't really apply to a government. Also the GAO has issued a constant stream of reports saying US government agencies have poor security. It was likely only a matter of time before something like this incident happened. Similarly it's probably only a matter of time until the IRS, Social Security, and other agencies are successfully attacked on a large scale.

nobody9999 6y ago
>True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Perhaps I'm a little dense, but I'm not sure what you're arguing here. Are you asserting that since sophisticated threat actors exist, security processes and procedures are useless, and as such, shouldn't be adhered to or implemented?
- rapjr9 6y ago
  No, I'm saying researchers ignored APT's for decades and now that they are available to everyone many current security processes and procedures are less effective, and yes possibly useless, _regardless_ of whether sophisticated threat actors exist (because their tools have been exposed). Current processes and procedures should still be used because they are all we have, but something new is also needed. Part of that something new should be an acknowledgement that systems are unprotectable, so instead of just security procedures we need, for example, faster recovery procedures (not just restore from backup). Another example might be dual implementations of systems, built with different technologies, so that when one is compromised the other is less likely to be susceptible to the same compromise. Expensive, but that may be what it takes to keep the world running. Splitting the internet into layers of VPN's with everything having it's own VPN might be useful too. The internet is fragmenting anyway, might as well fragment it in a useful way. Maybe everyone should have multiple physical computers as well, one for each work project, one for play, one for home finances, etc., each with tailored protections and no connections between them. I'm not sure what the answers are but it's obvious what is being done now is not good enough. I do fully expect to see the IRS hacked, chemical plants destroyed, factories stopped, etc. the way things are going now. Simple ransomware is already causing major problems and there seems to be no way to stop it and it's going to spread to all sectors and it seems likely there will be ransomware without the ransom too, just pure destruction. Already happened in Saudi Arabia.
  - nobody9999 6y ago
    >No, I'm saying researchers ignored APT's for decades That isn't even close to being true. In fact, that statement is ridiculous on its face. Research into detecting, mitigating and countering such attacks go back at least 30 years. That APT actors have often been successful is more a function of effective execution and poor security practices than lack of knowledge/research around such attacks.

by rapjr9 6y ago

nobody9999 6y ago

>True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Perhaps I'm a little dense, but I'm not sure what you're arguing here. Are you asserting that since sophisticated threat actors exist, security processes and procedures are useless, and as such, shouldn't be adhered to or implemented?

rapjr9 6y ago
No, I'm saying researchers ignored APT's for decades and now that they are available to everyone many current security processes and procedures are less effective, and yes possibly useless, _regardless_ of whether sophisticated threat actors exist (because their tools have been exposed). Current processes and procedures should still be used because they are all we have, but something new is also needed. Part of that something new should be an acknowledgement that systems are unprotectable, so instead of just security procedures we need, for example, faster recovery procedures (not just restore from backup). Another example might be dual implementations of systems, built with different technologies, so that when one is compromised the other is less likely to be susceptible to the same compromise. Expensive, but that may be what it takes to keep the world running. Splitting the internet into layers of VPN's with everything having it's own VPN might be useful too. The internet is fragmenting anyway, might as well fragment it in a useful way. Maybe everyone should have multiple physical computers as well, one for each work project, one for play, one for home finances, etc., each with tailored protections and no connections between them. I'm not sure what the answers are but it's obvious what is being done now is not good enough. I do fully expect to see the IRS hacked, chemical plants destroyed, factories stopped, etc. the way things are going now. Simple ransomware is already causing major problems and there seems to be no way to stop it and it's going to spread to all sectors and it seems likely there will be ransomware without the ransom too, just pure destruction. Already happened in Saudi Arabia.
- nobody9999 6y ago
  >No, I'm saying researchers ignored APT's for decades That isn't even close to being true. In fact, that statement is ridiculous on its face. Research into detecting, mitigating and countering such attacks go back at least 30 years. That APT actors have often been successful is more a function of effective execution and poor security practices than lack of knowledge/research around such attacks.