6 ms·
The EPA should hire pentesters to go through each utility and expose problems with this. Seems like it would do well in exposing the problem
by wyxuan 6y ago
The EPA should hire pentesters to go through each utility and expose problems with this. Seems like it would do well in exposing the problem
- lisper 6y agoYou're assuming that the goal here is to achieve security. It isn't. The goal here is to achieve the appearance of security. And that is not an entirely unreasonable approach because appearing to be secure can discourage people from even attempting an attack. Your home security system won't actually keep anyone who knows what they are doing from robbing your house if they decide to rob your house. What it could do is make them decide to rob your neighbor's house instead.
- buzzy_hacker 6y agoI think the analogy falls apart because clearly trying to appear secure isn’t deterring Russia/China from hacking US infrastructure.
- lisper 6y agoThat's true, but this almost certainly was not a state-level actor. When Russia or China decide to do damage to our infrastructure, they will almost certainly succeed. The deterrent in that case will be retaliation, not the appearance of security. But in no event can our civilian infrastructure be actually protected. It's just too hard. There's too much of it and there are too many people who legitimately need access.
- whatshisface 6y ago>When Russia or China decide to do damage to our infrastructure, they will almost certainly succeed. What if there are 100 attacks per year, with a 99% success rate?
- boomboomsubban 6y agoThere'd be 99 hacks and they missed just one. I don't get what you are asking.
- alasdair_ 6y agoWhat if there were lots of of successful hacks and this just happened to be the outlier because an admin was online and looking at the system at the exact moment the hack occurred? Any large adversary would compile a huge number of ways to disable infrastructure, then use them all at once, rather than one at a time.
- boomboomsubban 6y agoThe quote "When Russia or China decide to do damage to our infrastructure, they will almost certainly succeed," already made that point though.
- TeMPOraL 6y agoMaybe they are. But we can estimate that they're not too impactful - otherwise we'd notice either the attempts or the effects. If there are ongoing successful attacks, they do not cross the very important threshold, past which US government officials would start making public noises in the direction of nuclear chain of command.
- lupire 6y agoRussian government has quite successfully attacked our information infrastructure and goaded us into attacking ourselves. They didn't need any hacks; they walked right in the front door of Twitter x Facebook, et al.
- im3w1l 6y ago> Your home security system won't actually keep anyone who knows what they are doing from robbing your house Sure but it might keep out all the people who don't know what they are doing. Like some clueless junky.
- andrei_says_ 6y agoFun fact: addiction is a disease and not a choice. It is strongly related to trauma, ptsd, income inequality and other factors individuals don’t have a choice in. Classifying someone as a “junky” adopts a cruel and unrealistic worldview blaming the victim and absolving a number of powerful actors of their role in contributing to addiction on mass scale.
- eloff 6y agoA junky is a victim of powerful actors contributing to addiction? Presumably if we're talking about someone who got addicted to precipitation opioids and then turned to heroin, yes. You do have a point there. It's like the partner that cheats because she feels neglected. Yes that was a contributing factor, but at the end of the day nobody put a gun to their head - it was a (bad?) choice that they made. Yeah physical addiction to prescription drugs is a little different, a little closer to having a gun to your head, but still. What about those who were recreational drug users that went down a dark and dangerous path? Presumably in this case it's fair to put the blame on them. Yeah, maybe they had issues with their parents and maybe they had some other problems. But nobody put a gun to their head. They made a bad choice and paid the price. That's how life is. You can't absolve personal responsibility either.
- andrei_says_ 6y ago> What about those who were recreational drug users that went down a dark and dangerous path? What about the rev users who didn’t go down the dark path? This precisely is the difference of having genetic predisposition to addiction, trauma etc. No, it’s not a choice more than obesity / food addiction is. If you’re interested in expanding your thinking see the work of Gabor Mate.
- ketzo 6y agoThe article mentions that a huge number of water treatment facilities are controlled by publicly-accessible web portals. Maybe the goal isn't to make every single facility 100% secure to all threats, but it's totally defeatist to say that we couldn't somewhat increase the actual security of many systems. VPNs alone would provide a great first line of defense, and even for a government-run utility, the barrier to installation is very low there. I have a fair level of skepticism around security theatre, too, but I think it's unfairly cynical to suggest that we don't have a goal of making ourselves more secure.
- lordnacho 6y agoThere ought to be a second principle here: https://en.wikipedia.org/wiki/Kerckhoffs's_principle https://en.wikipedia.org/wiki/Kerckhoffs's_principle In addition to assuming the adversary knows how everything is designed (as opposed to security-by-obscurity) there should also be an assumption that security is obtained through real implementations, not theatre.
- sellyme 6y ago> Your home security system won't actually keep anyone who knows what they are doing from robbing your house if they decide to rob your house. What it could do is make them decide to rob your neighbor's house instead. What happens when everyone in my street buys the same security system? Seems like we all just spent a lot of money buying something that now offers us no benefit. Short of purchasing a honeypot property with (seemingly) no security system and going full Home Alone on the inside of it, it seems like you're going to need actual security at some point.
- pitaj 6y agoThey target a poorer neighborhood
- bobthepanda 6y agoThere's an old tale about this where everyone switched from brooms to vacuum cleaners to save work, which then caused a coal plant to be opened for the increased power demand, which proceeded to dirty everyone's homes so everyone was working just as hard for a slightly dirtier home than when they were using brooms. At least for the home example, you're usually better off reducing the factors that would make a break-in happen in the first place rather than trying to win an arms race against a determined attacker; there are high trust societies where people don't bother locking their doors and people don't get burgled. But obviously the threat model is different than a utility.
- TeMPOraL 6y ago> Short of purchasing a honeypot property with (seemingly) no security system and going full Home Alone on the inside of it, it seems like you're going to need actual security at some point. You mean men with guns stationed 24/7? There is no "actual security" against determined burglars available on the market for regular people. There's delaying action (e.g. laminated glass), noise making and deterrence (cameras). Each can be worked around. This is also a general point on security: there's no perfect security, there's only adequate security - where "adequate" means it costs the attacker more to breach it than they can expect to profit. From this view, appearance of security is almost as good as actual security measures - you make security look expensive to breach, which achieves the same effect, as long as nobody is willing to call your bluff.
- munk-a 6y agoI think you're vastly overestimating the budget the EPA is given and mistaking the goals that that money is meant to accomplish. Making some vendors that give politicians money look bad isn't a desired outcome.
- lupire 6y agoPoliticians don't run low level operations, and security contractors can give money to politicians too.
- toomuchtodo 6y agoYou need someone like the US Digital Service doing this with DHS. This gives you the force of federal law enforcement but the competence of skilled infosec practitioners on tours of duty short enough to enable high (“market rate”) comp but also results driven engagements. Bring back Chris Krebs, have this executed as part of CISA.