4 ms·
I know why orgs install central management systems (ease of maintenance at scale). But when one system can be used to compromise all the nodes in an org, is it
by _wldu 6y ago
I know why orgs install central management systems (ease of maintenance at scale). But when one system can be used to compromise all the nodes in an org, is it really worth it? Diversity is good for security.
I understand that Solarwinds is a reputable company with all the right security auditing and compliance credentials. That's why they are used by US federal and state government agencies.
Perhaps the criteria (MBA/Audit/Management driven security) that governments use to judge vendors is useless against real world attacks? If I wanted or needed to be compliant, I would buy that software (like all the other gov agencies), but if I wanted to be secure, I would not.
- bostik 6y ago> I know why orgs install central management systems (ease of maintenance at scale). But when one system can be used to compromise all the nodes in an org, is it really worth it? If you think about it, the modern cloud-native approaches are logically aiming for the same. You have a centralised management system (the cloud provider's engine), with programmatic configuration (infrastructure-as-code and indeed everything-as-code). We even call these modern best practices. Just instead of a webgui management console, we have git repos, and in place of two-person change protocol we have mandatory code reviews enforced by tooling. A single point of failure is one side of the coin. The side you're not looking at is single point of control.
- jabroni_salad 6y agoQuick question -- If you can't certify what exactly your computers have been doing, can you actually say that you are secure? It seems like not using NMS is just fast tracking yourself to become one of those orgs that gets owned for months and never even knows about it.
- _wldu 6y agoThis compromise supposedly goes back to March 2020. We're just learning about it now.