3 ms·
True, but it is important to quantify that inadequacy. SolarWinds was actually attacked by an actual threat and their defenses were comically outmatched by that
by Veserv 6y ago
True, but it is important to quantify that inadequacy. SolarWinds was actually attacked by an actual threat and their defenses were comically outmatched by that real threat who found real value in attacking them. We are not talking 10%-20% or even 100%, we are talking systems that need to improve by 1,000%-10,000% to provide credible defense against real foes. And this is not just SolarWinds, FireEye, a major cybersecurity company, needs to improve their security by a factor of 100x to protect their customers against people who actually wish to attack them. The security is not merely inadequate, it is inadequate to a degree that is almost mind-boggling. Systems are being deployed that are not even 1% of the necessary level of effectiveness. These organizations are completely incapable of developing and deploying adequate defenses.
This ignores the secondary problem which is that if the attacks being deployed are 100x stronger than the defenses, how hard is it to develop an attack that is merely 2x stronger than the defenses. If we lazily extrapolate this linearly, that would be 1/50th the resources to develop an attack that still outmatches the defenders. How many people do you think were on the SolarWinds attack? 10, 100, 1000? Even at 1000 that means you would only need 20 fulltime people for a year to develop a credible attack against nearly every Fortune 500 company in the world and most of the US government. That should be a terrifying concept. Obviously, this is lazy extrapolation, but it is not so off as to be non-illustrative of this problem.
Given this immense difference between real problems and available solutions, the only reasonable assumption for companies and people is to assume that they are completely defenseless against such actors and likely even largely defenseless against even poorly-resourced attacks as demonstrated time and time again. It is imperative that they act accordingly and only make systems accessible where the harm of guaranteed breach is less than the benefit of making those systems accessible.
- jrochkind1 6y agoI don't understand how you are measuring "security" quantitatively to say "1,000% - 10,000%" and "100x". But yeah, security is in a terrible spot, throughout the software industry. It is not clear to me what the steps would be to improve it. It is not clear to me whether these steps would increase software costs (something that is quantitative) by "1,000% - 10,000%", and if so how society as a whole could possibly afford it, in this society where we have put (insecure) software everywhere.
- Veserv 6y agoObviously it would depend on the situation, but in this case we could probably use a metric of something like mean-time-to-discovery which is probably a useful metric for evaluating intrusion detection. Making simplifying assumptions, we can just model this as a probability to discover per unit-time with percentage improvements reducing mean-time-to-discovery. In this case we have ~8 months to discovery or ~240 days. We then need to determine what we deem adequate for intrusion detection. I contend that a competent intrusion extracts the vast majority of its value within 1 week. This is consistent with the results in the Verizon Data Breach Report from 2019 [1]. Given this, we would logically want to detect an intrusion in less than this time otherwise the vast majority of the damage has already been done. By this metric, 1 week or 7 days versus 240 days would require a 35x or 3,500% improvement in detection by FireEye to be able to detect the intrusion and materially impact the value gained from the intrusion. In addition, this is not materially different than the standard in the industry as seen in the other graphs on that same page which shows that detection normally takes on the order of months which is far longer than the standard for exfiltration which is days to weeks. I do not contend that all software everywhere must be made secure against all attackers. However, it must be evaluated against actual expected attacks with a proper understanding as to what it can actually defend against otherwise it is impossible to make an accurate cost-benefit analysis. It is up to the creator/user/people to make an evaluation if the benefits outweigh the risks. That is how you define adequacy. [1] https://www.nist.gov/system/files/documents/2019/10/16/1-2-dbir-widup.pdf https://www.nist.gov/system/files/documents/2019/10/16/1-2-d... Page 10