5 ms·

It's almost like all of our institutions shouldn't use the exact same software vendors

jgalt212 6y ago
or Identity Providers.
exporectomy 6y ago
Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Is that the problem you'd hope to solve? That it all happened within a few days instead of at different institutions at different times?
- brundolf 6y ago
  Yes, distributing the same number of hacks over a period of time would on its own make things a little bit less fragile. In general, having a single point of failure is bad for the stability of any large system. But more likely: imagine all these orgs were distributed across three or four providers. A bad actor comes up with a zero-day for one of them. They can now a) go ahead and use that, far fewer systems are compromised and awareness of the threat is raised, or b) wait a much longer time until they come up with vulns for all the other systems. Either of those is less bad than the current situation. These days it's starting to feel like China might get to a point where they could shut down an entire country, all at once, with the flip of a switch.
  - exporectomy 6y ago
    One hack happening doesn't raise awareness for the risk of different unknown vulnerabilities in different software. So the total number of institutions getting hacked would be the same. It's not really one system. It just looks like that because it's one news story. If instead, all school districts were hacked this year and all police departments next year, how is that any better than both together? If it was one system like one network, your idea is even worse because having more different software increases the attack surface so hacking any one of those compromises the whole system. Would you personally use uncommon software to avoid being part of a big hack like this? I don't think that's a valid way of protecting yourself. Your idea would make sense if many of these institutions were just providing services that were redundant with each other. Then if some of them are disabled, the others can take their place. But a police department's email server can't do the job of a school district's one. And if confidential information is taken in a hack, redundancy doesn't help at all.
  - ISL 6y ago
    The opening volleys of major future conflicts might be coincident with each country shutting down the other's computers.
  - rcoveson 6y ago
    Right. Software diversity (as long as it's real, all-the-way-down diversity and not just different branding of the same tech) is beneficial to overall security for more or less the same reasons that gene pool diversity is beneficial to the survival of a species. This is one instance where our choice of metaphorical vocabulary, like "virus", is very apt. Only one vendor for all corporate email is bad for the same reason that only one popular variety of banana is bad.
- tablespoon 6y ago
  > Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Yes, but you're describing a more resilient system. A monoculture can get totally knocked out by one vulnerability.
throwawayboise 6y ago
It's almost like we shouldn't indiscriminately connect everything to the internet.
- brundolf 6y ago
  I mean in this case it was email, so I don't know how you usefully disconnect that from the internet
  - throwawayboise 6y ago
    The attacks were on port 443, i.e. the webmail interface. That could be behind a VPN.
    - riffic 6y ago
      zero trust my pal. vpns are over.
      - throwawayboise 6y ago
        Sure VPNs aren't perfect. Nothing is. It's layers. Defense in depth. Of course the users don't like having to connect to VPN to read their email. Pick your poison.
        arcturus17 6y ago
        The consumer VPN market looks like a snake pit of spyware and shadiness. The tin says “Hide yourself and your data” and there have been reports that some companies are doing the exact opposite: funneling it to shady actors across the world. And this is not even a freemium product in many cases! I’d assume the enterprise segment is not as bad, but I’d also assume GP is talking about something along these lines - that you can’t trust vendors for anything these days.
        lifty 6y ago
deleted 6y ago
[deleted]
px43 6y ago
I'd rather just hate on Microsoft specifically :-p

or Identity Providers.

Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Is that the problem you'd hope to solve? That it all happened within a few days instead of at different institutions at different times?

brundolf 6y ago
Yes, distributing the same number of hacks over a period of time would on its own make things a little bit less fragile. In general, having a single point of failure is bad for the stability of any large system. But more likely: imagine all these orgs were distributed across three or four providers. A bad actor comes up with a zero-day for one of them. They can now a) go ahead and use that, far fewer systems are compromised and awareness of the threat is raised, or b) wait a much longer time until they come up with vulns for all the other systems. Either of those is less bad than the current situation. These days it's starting to feel like China might get to a point where they could shut down an entire country, all at once, with the flip of a switch.
- exporectomy 6y ago
  One hack happening doesn't raise awareness for the risk of different unknown vulnerabilities in different software. So the total number of institutions getting hacked would be the same. It's not really one system. It just looks like that because it's one news story. If instead, all school districts were hacked this year and all police departments next year, how is that any better than both together? If it was one system like one network, your idea is even worse because having more different software increases the attack surface so hacking any one of those compromises the whole system. Would you personally use uncommon software to avoid being part of a big hack like this? I don't think that's a valid way of protecting yourself. Your idea would make sense if many of these institutions were just providing services that were redundant with each other. Then if some of them are disabled, the others can take their place. But a police department's email server can't do the job of a school district's one. And if confidential information is taken in a hack, redundancy doesn't help at all.
- ISL 6y ago
  The opening volleys of major future conflicts might be coincident with each country shutting down the other's computers.
- rcoveson 6y ago
  Right. Software diversity (as long as it's real, all-the-way-down diversity and not just different branding of the same tech) is beneficial to overall security for more or less the same reasons that gene pool diversity is beneficial to the survival of a species. This is one instance where our choice of metaphorical vocabulary, like "virus", is very apt. Only one vendor for all corporate email is bad for the same reason that only one popular variety of banana is bad.
tablespoon 6y ago
> Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Yes, but you're describing a more resilient system. A monoculture can get totally knocked out by one vulnerability.

throwawayboise 6y ago

It's almost like we shouldn't indiscriminately connect everything to the internet.

brundolf 6y ago
I mean in this case it was email, so I don't know how you usefully disconnect that from the internet
- throwawayboise 6y ago
  The attacks were on port 443, i.e. the webmail interface. That could be behind a VPN.
  - riffic 6y ago
    zero trust my pal. vpns are over.
    - throwawayboise 6y ago
      Sure VPNs aren't perfect. Nothing is. It's layers. Defense in depth. Of course the users don't like having to connect to VPN to read their email. Pick your poison.
      - arcturus17 6y ago
        The consumer VPN market looks like a snake pit of spyware and shadiness. The tin says “Hide yourself and your data” and there have been reports that some companies are doing the exact opposite: funneling it to shady actors across the world. And this is not even a freemium product in many cases! I’d assume the enterprise segment is not as bad, but I’d also assume GP is talking about something along these lines - that you can’t trust vendors for anything these days.
        lifty 6y ago

deleted 6y ago

[deleted]

px43 6y ago

I'd rather just hate on Microsoft specifically :-p