4 ms·
It's official If you are stupid enough to accept the advanced persistent state sponsored threat argument And you're dense enough to give these guys a second ch
by nimbius 6y ago
It's official
If you are stupid enough to accept the advanced persistent state sponsored threat argument
And you're dense enough to give these guys a second chance
Then you should just fire your engineers and base your entire life out of the Gartner trade rag magic quadrants.
- unclekev 6y ago> base your entire life out of the Gartner trade rag magic quadrants Seems to work pretty well for a lot of the CIO/CTO level people who I have worked with. Unfortunately.
- olefoo 6y agoRemember that these individuals are usually hired and given responsibility based on their ability to game class signalling games; they exist to justify the status quo. If the status quo were more justifiable their actual job responsibilities to other people within the organization ( conflict resolution, scheduling, resource allocation, and personnel management) are things that could be automated in a hot minute.
- gabereiser 6y agoI don’t know about full automation, but I can confirm that in large f500 companies, Gartner holds a lot of weight. Most follow their recommendations. I’m guilty too of using that argument: “According to Gartner...” to give weight to my position when talking to C-level folks. I wish I didn’t have to, but lots of folks trust their recommendations.
- keyle 6y agoI'm either too old or too young to understand anything of what you've just said.
- TechBro8615 6y agoNot OP, but pretty sure he’s saying that if you’re eg a CISO who’s naive enough to accept whatever argument is fed to you for why this is a “state sponsored attack” (implying that it’s not), then you may as well reduce your professional decision making to favoring whatever Gartner recommends in their “magic quadrant” marketing materials.
- mike_d 6y agoIt would be impossible for this to be the attack vector used. While these credentials let you push things to the download servers, the actual malware was inserted much earlier during the build process before the code was signed.
- dyslexit 6y agoThis flaw is from a year ago and had nothing to do with the recent hack. The discourse in these posts that often involve a certain country tend to always lean more towards people's political beliefs rather than anything actually being reported in the story.
- deleted 6y ago[deleted]
- mimikatz 6y agoSolarwinds was dumb, but this definitely was an advanced attacker who hit FireEye, DHS, and Treasury. They had ownership of over 18,000 solarwinds servers and went after 10 or less orgs. When they did, the attacks they used were complex. It was very clearly as a state sponsored action and I don't understand why you would dismiss that.
- TechBro8615 6y agoYou seem to be asserting that it’s “very clear” with basically zero justification for why it’s so clear.
- jjulius 6y agoIt's clear that the justification is in the two sentences preceding the "very clear" comment.
- TechBro8615 6y agoOP’s first sentence says Solarwinds was dumb. If anything, isn’t that evidence of the attack requiring less sophistication than one that excludes all but well funded attackers?
- W-Stool 6y ago"base your entire life out of the Gartner trade rag magic quadrants." You just described the CIO of a billion dollar revenue NYSE traded company I was with briefly a few years back. The CIO had no degree and thought the Gartner organization could do no wrong, so they were his guide and trusted confidant. It was a nightmare, a total disaster. Everyone in IT there were so used to constant chaos no one seemed to notice or mind. Yikes.