20 ms·

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire r

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the particular product/service/vendor in question. And no firewalls or routers would be massive, disqualifying red flags on such a questionnaire. Never mind that a KISS setup tends to bring security because of its minimized attack surface. In the minds that write and administer those questionnaires, security only comes from sufficient amounts of the right kinds of complexity. I'm sure it can be done. IIRC, Cloudflare doesn't use any firewalls, and they do some big business. It just isn't easy to get past the droids programmed to ensure that all pegs shall be properly square, IME.

rsync 6y ago
"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc. We're also very honest about how we approach these issues: https://www.rsync.net/resources/regulatory/pci.html https://www.rsync.net/resources/regulatory/pci.html ... and they generally appreciate the honesty.
- chris_wot 6y ago
  Man, everything about your service is simple and direct! Amazing.
- learn_more 6y ago
  FYI, your "pricing" link at the top of that pci.html page 404's. The pricing link works from other pages however.
  - rsync 6y ago
    I see that that has now been fixed - thanks for pointing it out.
    - punnerud 6y ago
      The “burger menu” does not work on iPhone. Works from the front page.
    - colejohnson66 6y ago
      If we’re discussing website bugs, the “SSAE16 / SAS70” page[0] mentions 2015 as “upcoming” [0]: https://www.rsync.net/resources/regulatory/sas70.html https://www.rsync.net/resources/regulatory/sas70.html
- deleted 6y ago
  [deleted]
- divbzero 6y ago
  This is extremely honest and transparent. In addition to being good marketing, it probably attracts customers who won’t make BS support requests.
- high_byte 6y ago
  > Our platform only answers on port 22 with OpenSSH. I do security and I title this "Most secured platform in the world."
  - StavrosK 6y ago
    Oh yeah? Well I run one where no ports are open. In fact, I haven't even connected it to the network.
    - batch12 6y ago
      I'll raise you-- I have one that I keep powered off...
      - StavrosK 6y ago
        I can top that: I don't have one.
        rubiquity 6y ago
        What are you two even talking about?
        paulmd 6y ago
        The three golden rules of computer security: do not own a computer, do not power it on, and do not use it. https://en.wikipedia.org/wiki/Robert_Morris_(cryptographer) https://en.wikipedia.org/wiki/Robert_Morris_(cryptographer)
        rubiquity 6y ago
        A compo what?!
        krylon 6y ago
        That's nothing. I don't have thousands.
- navaati 6y ago
  It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_report.pdf https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.
  - vidarh 6y ago
    I once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.
    - Alupis 6y ago
      Well, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes). I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks). PCI prefers systems that handle CHD be "invisible" to the outside world, in an attempt to hide the systems an attacker might take interest in. Not always feasible (eCommerce, for example), but you gotta jump through the PCI hoops if you don't want to be stuck holding the bag if there's some breach.
      - darkarmani 6y ago
        PCI compliance is to reduce the chances of legal liability. Better security is sometimes a side-effect of that compliance.
        humaniania 6y ago
        To reduce the liability of the credit card company maybe, by making the process so complex and onerous that it is virtually impossible to complete a survey without some error or omission that would almost assuredly be used as a reason to invalidate any liability for the credit card company should some bad event take place. Source: have had to complete PCI surveys from multiple vendors.
- ornornor 6y ago
  Been a happy customer for a while now, really love what you’re doing. I wish more companies were as direct and competent.
- tinco 6y ago
  Isn't the nice thing about having an access fortress, that you can monitor the access more simply? Or is it just as simple for you to monitor access to all the identically configured machines? I suppose it might be.
  - kubanczyk 6y ago
    I believe the usual name is a bastion host, not an access fortress.
- TheTaytay 6y ago
  I was just lamenting the state of these forms today. I feel like many of the questions are variations on the theme of “what antivirus software do you use to protect your basement mainframe from your corporate network traffic?” “N/A” isn’t a long enough answer, so it feels like you need to keep explaining “the Internet”, LLC of a centralized corporate network, SaaS, etc. Is there a modern, no-nonsense guide to filling these out honestly without telling the person doing the checkbox checking that their form is dumb? I realize there’s a lot of rent seeking and money to be made by consultants in this space - I’m looking for the GitHub published guide or wiki to help smaller no-nonsense shops navigate the phrasing and map these vendor security questionnaires to “modern” technology.
  - TheTaytay 6y ago
    This is going to look like I'm a plant with the timing of my comment and this "Launch HN" post that just made it to the front page, but with that out of the way: https://news.ycombinator.com/item?id=26513040 https://news.ycombinator.com/item?id=26513040 Looks like Stacksi is aiming to fix this pain point.
vel0city 6y ago
Cloudflare not using any firewalls seems like a strange concept, considering they literally sell firewall-as-a-service. https://www.cloudflare.com/waf/ https://www.cloudflare.com/waf/
- dr-smooth 6y ago
  A WAF is not the same thing as a general-purpose firewall. Think of it as a web proxy with filtering capabilities.
  - korethr 6y ago
    Yeah, I find myself kinda annoyed at the term WAF, as it overloads the term "firewall". But your description is quite accurate. Whether you're doing your filtering with an expensive F5 Big-IP with its nifty glowy logo on the front bezel, an haproxy instance from some WAF-as-a-service vendor, or Nginx and some plugins running on a VM, any of those, done right, can serve in a WAF role. I say that now, but I wish I understood that a few years ago, when faced with the WAF line item on an a WAF, promptly went "WTF is a WAF? googles No, we have a WAF." Could have saved myself some security audit pain. On the flip side, I did manage to get some upgrade budget out of failing that battery of line items.
    - vel0city 6y ago
      It seems to me the basic definition of a firewall is: "A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules." https://www.cisco.com/c/en/us/products/security/firewalls/what-is-a-firewall.html https://www.cisco.com/c/en/us/products/security/firewalls/wh... "usually firewall \ ˈfī(- ə)r- ˌwȯl \ : computer hardware or software that prevents unauthorized access to private data (as on a company's local area network or intranet) by outside computer users (as of the Internet)" https://www.merriam-webster.com/dictionary/firewall https://www.merriam-webster.com/dictionary/firewall This and other "web application firewalls" seem to meet these kinds of definitions. Add to the fact more and more "traditional" firewall appliances are adding behavioral filtering and have had application tracking for decades and we're far from firewall being limited to only a layer 3 device.
deadlyllama 6y ago
I used to (late 2000s) work for a tiny, tiny company that was courting a customer in the mobile banking space. They wanted us to tick boxes. So we bought a box (some sort of Fortinet) that said it was a firewall and IDS. Plugged it in, used it as our new router. "Cost of doing business." Could we have argued with them during the sales process? Only if we wanted to lose the sale. The Fortinet was cheap compared to the value of the contract.
- deleted 6y ago
  [deleted]
- ev1 6y ago
  Cost of doing business, or ... introducing new Fortinet vulnerabilities into your infrastructure? I know you mentioned 2000s, but it's funny that these contractually obligated boxes might introduce more worry: https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-vulnerabilities-in-ssl-vpn-and-web-firewall/ https://www.bleepingcomputer.com/news/security/fortinet-fixe...
  - high_byte 6y ago
    lol. anti-viruses are the virus. the ultimate virus. don't execute any binary and you'll be fine.
  - rhizome 6y ago
    Which is exactly what Kozubik was talking about!
  - bigiain 6y ago
    I guess you can still tick all the compliance checkboxes if you install the contractually obligated Fortinet device outside your DMZ and internally treat it as no more trusted that the rest of the internet...
  - kubanczyk 6y ago
    Exactly. My first thought was: did they install Solarwinds as well?
bawolff 6y ago
> In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the particular product/service/vendor in question. And in many cases on the vendor side its some dude from sales filling it out... so pretty noisey on both ends.
- brazzledazzle 6y ago
  Which seems somewhat questionable. It seems like you’d want someone to fill it out that had a less direct interest in a closed sale. Getting hacked is one thing but getting caught lying on a security evaluation could really harm the company’s ability to secure future enterprise customers.
  - acdha 6y ago
    > Getting hacked is one thing but getting caught lying on a security evaluation could really harm the company’s ability to secure future enterprise customers. “Could” being the key term here: unless it’s epically bad and unequivocal, there are pretty good odds they could skate a long time without anyone asking and even if they did it might end up simply being that they blame long-departed sales guy and patch things up with the CIO over martinis.
wirrbel 6y ago
> In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today,... They may be even aware, they are just bound by their companys ruleset...
bob1029 6y ago
Anything is possible if you are willing to get a little dirty and negotiate with other humans. We initially had some troubles navigating these waters in the financial sector, but once we were able to convince 1 big customer to try our system on a trial basis, everyone else started to play along really nicely. No one wants to be the first one to try a new thing and get burned by it. In 2021, you can sometimes leverage things like technological FOMO to make a business owner believe that they are going to lose out on future business value relative to competition, who you might frame as be willing to take on a bigger technological risk. And indeed, smaller clients in our industry are willing to overlook certain audit points (at least temporarily) in order to compete with bigger players. Some might not like it, but being able to engage in the sales process and bend some rules occasionally is absolutely required to play in the big leagues. Once you are in, it's a lot easier to move around. No one has a perfect solution and everyone knows it. It's just a matter of who is the better sales person at a certain point.
kortilla 6y ago
> I'm sure it can be done. IIRC, Cloudflare doesn't use any firewalls This is a little disingenuous because their product is a modern firewall. It drops packets and conditionally allows sessions to your backend.
- korethr 6y ago
  While I agree with your assessment that Cloudflare serves as a modern firewall, I disagree with your assessment of disingenuousness. My lament was mainly at the more robotic and/or malicious "auditors" and "compliance officers" who will mark one or more line items as a critical failure if you don't have one or more Cisco Firepower/Juniper SRX/Fortinet Fortigate/Meraki MX/Barracuda NG/etc in your network such that its position in the network diagram means that it protects you from Evil Hackers. And AFAIK, while cloudflare's service is a sort of firewall, they don't use any traditional layer 4, layer 7, or 'next-generation' firewall appliances to get that result.
  - kortilla 6y ago
    > any traditional layer 4, layer 7, or 'next-generation' firewall appliances to get that result. Cloudflare’s product is just a web application firewall as a service. It’s not magic. The major difference between Cloudflare and a pizza box WAF is the global distributed nature to absorb ddos in the same product. The things it does to the packets are the same though.
hayst4ck 6y ago
On one hand, a firewall that accepts incoming port 22 connections isn't that different from only having port 22 listening. On the other hand, a firewall is an explicit declaration of the ports you want open and who you want them open to, which seems like, at the very least, a useful thing to do. If nothing else it seems like defense in depth. I'm not sure I buy that a system designed around "default deny" is an increase in secrity complexity, certainly it's complexity that would hurt availability, but complexity that would hurt security? Either way, the real security comes from monitoring the reality of what ports are actually open/listening and verifying a person's assumptions about their systems.
- okl 6y ago
  > [...] but complexity that would hurt security? Higher complexity = larger attack surface. For example, if they used a firewall with one of Cisco's infamous backdoors. https://www.zdnet.com/article/cisco-removed-its-seventh-backdoor-account-this-year-and-thats-a-good-thing/ https://www.zdnet.com/article/cisco-removed-its-seventh-back...
  - ac29 6y ago
    Isnt a firewall largely a defense in depth thing? If everything is working perfectly and the firewall gets compromised, then yes, you'd just be listening to port 22 with SSH anyways, so it wouldn't really matter. But if something went wrong on the system behind the firewall (configuration mistake, software defect, malware, hacking) but the firewall itself was still secure, it would limit the damage that could be done.
    - hayst4ck 6y ago
      A FreeBSD machine running as a firewall might make sense without significantly increasing attack surface. But inviting a new hardware product into your infra is a significant increase in attack surface. SolarWinds is a very fresh example of a catastrophic supply chain attack and a clear example why it might not be a defense in depth thing. If your network is secure, and a well configured machine only listening on port 22 is pretty secure, you have to ask how the production machine will interact with the outside world. Well every update is an inverse remote code execution. You are getting remote code from an external location and then running it directly in production. So while you might trust FreeBSDs package manager, do you trust Cisco? Do you trust SolarWinds? Even if you do, it's hard to argue that your attack surface hasn't been increased.
pezezin 6y ago
> ...incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today... You just described my workplace. We have some rules that nobody understands and nobody remembers where they come from, but we have to follow them blindly. For example, they require that any access to the web services should go through a VPN, which would be fine if: - The VPN actually worked, but it doesn't. - The servers already uses TLSv1.3, all the services require user authentication, and there are 3 layers of firewalls and an integrated virus scanner in front of the services. - We are an international project with people from 10 different organizations in 6 countries on 2 continents, and it's really difficult to impose these kind of rules. So for example, I'm managing a GitLab instance that I can't use myself. I can only SSH login from a very specific computer to manage it, but I can't upload my own code from my office computer. And I don't want to go into their blind devotion to the firewall and their concept of one way connections... So I'm just letting time go by, until everybody is so angry they are finally forced to change. Doesn't help that this is Japan, the epitome of rigidness and "even it is broken, don't fix it".
mattl 6y ago
Disney, 3M and ARM are on the website.
akvadrako 6y ago
> Never mind that a KISS setup tends to bring security because of its minimized attack surface Security is also about depth. You should assume breaches can happen and have another level of defense. That only increases the attack surface but it's a much better approach for imperfect beings.
- lmm 6y ago
  In my experience that approach actually ends up leading to weaker security. When you have 5 or 6 security layers it's not clear which ones are important; people get confused about which parts can be safely bypassed and how, and you end up with a swiss cheese where sooner or later all of the holes line up. Having a really clear distinction between public and private services works better.
  - Too 6y ago
    In a way yes. I'm sure everyone here has heard "This service can only be accessed on VPN anyway so we don't need authenticated access or care about security in the service itself".

rsync 6y ago

"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc. We're also very honest about how we approach these issues: https://www.rsync.net/resources/regulatory/pci.html https://www.rsync.net/resources/regulatory/pci.html ... and they generally appreciate the honesty.

chris_wot 6y ago
Man, everything about your service is simple and direct! Amazing.
learn_more 6y ago
FYI, your "pricing" link at the top of that pci.html page 404's. The pricing link works from other pages however.
- rsync 6y ago
  I see that that has now been fixed - thanks for pointing it out.
  - punnerud 6y ago
    The “burger menu” does not work on iPhone. Works from the front page.
  - colejohnson66 6y ago
    If we’re discussing website bugs, the “SSAE16 / SAS70” page[0] mentions 2015 as “upcoming” [0]: https://www.rsync.net/resources/regulatory/sas70.html https://www.rsync.net/resources/regulatory/sas70.html
deleted 6y ago
[deleted]
divbzero 6y ago
This is extremely honest and transparent. In addition to being good marketing, it probably attracts customers who won’t make BS support requests.
high_byte 6y ago
> Our platform only answers on port 22 with OpenSSH. I do security and I title this "Most secured platform in the world."
- StavrosK 6y ago
  Oh yeah? Well I run one where no ports are open. In fact, I haven't even connected it to the network.
  - batch12 6y ago
    I'll raise you-- I have one that I keep powered off...
    - StavrosK 6y ago
      I can top that: I don't have one.
      - rubiquity 6y ago
        What are you two even talking about?
        paulmd 6y ago
        The three golden rules of computer security: do not own a computer, do not power it on, and do not use it. https://en.wikipedia.org/wiki/Robert_Morris_(cryptographer) https://en.wikipedia.org/wiki/Robert_Morris_(cryptographer)
        rubiquity 6y ago
        A compo what?!
      - krylon 6y ago
        That's nothing. I don't have thousands.
navaati 6y ago
It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_report.pdf https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.
- vidarh 6y ago
  I once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.
  - Alupis 6y ago
    Well, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes). I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks). PCI prefers systems that handle CHD be "invisible" to the outside world, in an attempt to hide the systems an attacker might take interest in. Not always feasible (eCommerce, for example), but you gotta jump through the PCI hoops if you don't want to be stuck holding the bag if there's some breach.
    - darkarmani 6y ago
      PCI compliance is to reduce the chances of legal liability. Better security is sometimes a side-effect of that compliance.
      - humaniania 6y ago
        To reduce the liability of the credit card company maybe, by making the process so complex and onerous that it is virtually impossible to complete a survey without some error or omission that would almost assuredly be used as a reason to invalidate any liability for the credit card company should some bad event take place. Source: have had to complete PCI surveys from multiple vendors.
ornornor 6y ago
Been a happy customer for a while now, really love what you’re doing. I wish more companies were as direct and competent.
tinco 6y ago
Isn't the nice thing about having an access fortress, that you can monitor the access more simply? Or is it just as simple for you to monitor access to all the identically configured machines? I suppose it might be.
- kubanczyk 6y ago
  I believe the usual name is a bastion host, not an access fortress.
TheTaytay 6y ago
I was just lamenting the state of these forms today. I feel like many of the questions are variations on the theme of “what antivirus software do you use to protect your basement mainframe from your corporate network traffic?” “N/A” isn’t a long enough answer, so it feels like you need to keep explaining “the Internet”, LLC of a centralized corporate network, SaaS, etc. Is there a modern, no-nonsense guide to filling these out honestly without telling the person doing the checkbox checking that their form is dumb? I realize there’s a lot of rent seeking and money to be made by consultants in this space - I’m looking for the GitHub published guide or wiki to help smaller no-nonsense shops navigate the phrasing and map these vendor security questionnaires to “modern” technology.
- TheTaytay 6y ago
  This is going to look like I'm a plant with the timing of my comment and this "Launch HN" post that just made it to the front page, but with that out of the way: https://news.ycombinator.com/item?id=26513040 https://news.ycombinator.com/item?id=26513040 Looks like Stacksi is aiming to fix this pain point.

vel0city 6y ago

Cloudflare not using any firewalls seems like a strange concept, considering they literally sell firewall-as-a-service. https://www.cloudflare.com/waf/ https://www.cloudflare.com/waf/

dr-smooth 6y ago
A WAF is not the same thing as a general-purpose firewall. Think of it as a web proxy with filtering capabilities.
- korethr 6y ago
  Yeah, I find myself kinda annoyed at the term WAF, as it overloads the term "firewall". But your description is quite accurate. Whether you're doing your filtering with an expensive F5 Big-IP with its nifty glowy logo on the front bezel, an haproxy instance from some WAF-as-a-service vendor, or Nginx and some plugins running on a VM, any of those, done right, can serve in a WAF role. I say that now, but I wish I understood that a few years ago, when faced with the WAF line item on an a WAF, promptly went "WTF is a WAF? googles No, we have a WAF." Could have saved myself some security audit pain. On the flip side, I did manage to get some upgrade budget out of failing that battery of line items.
  - vel0city 6y ago
    It seems to me the basic definition of a firewall is: "A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules." https://www.cisco.com/c/en/us/products/security/firewalls/what-is-a-firewall.html https://www.cisco.com/c/en/us/products/security/firewalls/wh... "usually firewall \ ˈfī(- ə)r- ˌwȯl \ : computer hardware or software that prevents unauthorized access to private data (as on a company's local area network or intranet) by outside computer users (as of the Internet)" https://www.merriam-webster.com/dictionary/firewall https://www.merriam-webster.com/dictionary/firewall This and other "web application firewalls" seem to meet these kinds of definitions. Add to the fact more and more "traditional" firewall appliances are adding behavioral filtering and have had application tracking for decades and we're far from firewall being limited to only a layer 3 device.

deadlyllama 6y ago

I used to (late 2000s) work for a tiny, tiny company that was courting a customer in the mobile banking space. They wanted us to tick boxes. So we bought a box (some sort of Fortinet) that said it was a firewall and IDS. Plugged it in, used it as our new router. "Cost of doing business." Could we have argued with them during the sales process? Only if we wanted to lose the sale. The Fortinet was cheap compared to the value of the contract.

deleted 6y ago
[deleted]
ev1 6y ago
Cost of doing business, or ... introducing new Fortinet vulnerabilities into your infrastructure? I know you mentioned 2000s, but it's funny that these contractually obligated boxes might introduce more worry: https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-vulnerabilities-in-ssl-vpn-and-web-firewall/ https://www.bleepingcomputer.com/news/security/fortinet-fixe...
- high_byte 6y ago
  lol. anti-viruses are the virus. the ultimate virus. don't execute any binary and you'll be fine.
- rhizome 6y ago
  Which is exactly what Kozubik was talking about!
- bigiain 6y ago
  I guess you can still tick all the compliance checkboxes if you install the contractually obligated Fortinet device outside your DMZ and internally treat it as no more trusted that the rest of the internet...
- kubanczyk 6y ago
  Exactly. My first thought was: did they install Solarwinds as well?

bawolff 6y ago

> In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the particular product/service/vendor in question. And in many cases on the vendor side its some dude from sales filling it out... so pretty noisey on both ends.

brazzledazzle 6y ago
Which seems somewhat questionable. It seems like you’d want someone to fill it out that had a less direct interest in a closed sale. Getting hacked is one thing but getting caught lying on a security evaluation could really harm the company’s ability to secure future enterprise customers.
- acdha 6y ago
  > Getting hacked is one thing but getting caught lying on a security evaluation could really harm the company’s ability to secure future enterprise customers. “Could” being the key term here: unless it’s epically bad and unequivocal, there are pretty good odds they could skate a long time without anyone asking and even if they did it might end up simply being that they blame long-departed sales guy and patch things up with the CIO over martinis.

wirrbel 6y ago

> In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today,... They may be even aware, they are just bound by their companys ruleset...

bob1029 6y ago

Anything is possible if you are willing to get a little dirty and negotiate with other humans. We initially had some troubles navigating these waters in the financial sector, but once we were able to convince 1 big customer to try our system on a trial basis, everyone else started to play along really nicely. No one wants to be the first one to try a new thing and get burned by it. In 2021, you can sometimes leverage things like technological FOMO to make a business owner believe that they are going to lose out on future business value relative to competition, who you might frame as be willing to take on a bigger technological risk. And indeed, smaller clients in our industry are willing to overlook certain audit points (at least temporarily) in order to compete with bigger players. Some might not like it, but being able to engage in the sales process and bend some rules occasionally is absolutely required to play in the big leagues. Once you are in, it's a lot easier to move around. No one has a perfect solution and everyone knows it. It's just a matter of who is the better sales person at a certain point.

kortilla 6y ago

> I'm sure it can be done. IIRC, Cloudflare doesn't use any firewalls This is a little disingenuous because their product is a modern firewall. It drops packets and conditionally allows sessions to your backend.

korethr 6y ago
While I agree with your assessment that Cloudflare serves as a modern firewall, I disagree with your assessment of disingenuousness. My lament was mainly at the more robotic and/or malicious "auditors" and "compliance officers" who will mark one or more line items as a critical failure if you don't have one or more Cisco Firepower/Juniper SRX/Fortinet Fortigate/Meraki MX/Barracuda NG/etc in your network such that its position in the network diagram means that it protects you from Evil Hackers. And AFAIK, while cloudflare's service is a sort of firewall, they don't use any traditional layer 4, layer 7, or 'next-generation' firewall appliances to get that result.
- kortilla 6y ago
  > any traditional layer 4, layer 7, or 'next-generation' firewall appliances to get that result. Cloudflare’s product is just a web application firewall as a service. It’s not magic. The major difference between Cloudflare and a pizza box WAF is the global distributed nature to absorb ddos in the same product. The things it does to the packets are the same though.

hayst4ck 6y ago

On one hand, a firewall that accepts incoming port 22 connections isn't that different from only having port 22 listening. On the other hand, a firewall is an explicit declaration of the ports you want open and who you want them open to, which seems like, at the very least, a useful thing to do. If nothing else it seems like defense in depth. I'm not sure I buy that a system designed around "default deny" is an increase in secrity complexity, certainly it's complexity that would hurt availability, but complexity that would hurt security? Either way, the real security comes from monitoring the reality of what ports are actually open/listening and verifying a person's assumptions about their systems.

okl 6y ago
> [...] but complexity that would hurt security? Higher complexity = larger attack surface. For example, if they used a firewall with one of Cisco's infamous backdoors. https://www.zdnet.com/article/cisco-removed-its-seventh-backdoor-account-this-year-and-thats-a-good-thing/ https://www.zdnet.com/article/cisco-removed-its-seventh-back...
- ac29 6y ago
  Isnt a firewall largely a defense in depth thing? If everything is working perfectly and the firewall gets compromised, then yes, you'd just be listening to port 22 with SSH anyways, so it wouldn't really matter. But if something went wrong on the system behind the firewall (configuration mistake, software defect, malware, hacking) but the firewall itself was still secure, it would limit the damage that could be done.
  - hayst4ck 6y ago
    A FreeBSD machine running as a firewall might make sense without significantly increasing attack surface. But inviting a new hardware product into your infra is a significant increase in attack surface. SolarWinds is a very fresh example of a catastrophic supply chain attack and a clear example why it might not be a defense in depth thing. If your network is secure, and a well configured machine only listening on port 22 is pretty secure, you have to ask how the production machine will interact with the outside world. Well every update is an inverse remote code execution. You are getting remote code from an external location and then running it directly in production. So while you might trust FreeBSDs package manager, do you trust Cisco? Do you trust SolarWinds? Even if you do, it's hard to argue that your attack surface hasn't been increased.

pezezin 6y ago

> ...incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today... You just described my workplace. We have some rules that nobody understands and nobody remembers where they come from, but we have to follow them blindly. For example, they require that any access to the web services should go through a VPN, which would be fine if: - The VPN actually worked, but it doesn't. - The servers already uses TLSv1.3, all the services require user authentication, and there are 3 layers of firewalls and an integrated virus scanner in front of the services. - We are an international project with people from 10 different organizations in 6 countries on 2 continents, and it's really difficult to impose these kind of rules. So for example, I'm managing a GitLab instance that I can't use myself. I can only SSH login from a very specific computer to manage it, but I can't upload my own code from my office computer. And I don't want to go into their blind devotion to the firewall and their concept of one way connections... So I'm just letting time go by, until everybody is so angry they are finally forced to change. Doesn't help that this is Japan, the epitome of rigidness and "even it is broken, don't fix it".

mattl 6y ago

Disney, 3M and ARM are on the website.

akvadrako 6y ago

> Never mind that a KISS setup tends to bring security because of its minimized attack surface Security is also about depth. You should assume breaches can happen and have another level of defense. That only increases the attack surface but it's a much better approach for imperfect beings.

lmm 6y ago
In my experience that approach actually ends up leading to weaker security. When you have 5 or 6 security layers it's not clear which ones are important; people get confused about which parts can be safely bypassed and how, and you end up with a swiss cheese where sooner or later all of the holes line up. Having a really clear distinction between public and private services works better.
- Too 6y ago
  In a way yes. I'm sure everyone here has heard "This service can only be accessed on VPN anyway so we don't need authenticated access or care about security in the service itself".