5 ms·

Cyber defense seems basically impossible. Actually securing systems would require a massive rethink of systems architecture and replacing many hundreds of mill

by wffurr 6y ago

Cyber defense seems basically impossible. Actually securing systems would require a massive rethink of systems architecture and replacing many hundreds of millions or billions of lines of existing code. MAD doesn't work with non-state actors, and it only works with state actors if you're actually willing to go to the mat, which I don't think the US is. So what does that leave? Hope? Not much of a strategy.

mschuster91 6y ago
> So what does that leave? Hope? Not much of a strategy. Open Source everything that is IT in government - from the basic design specifications to actual infrastructure configuration - and pay sizeable bug bounties (to the tune of at least 100k per bug) to incentivize third party experts is a very valid strategy. It is also a great way to get contributions/feedback for improvement ideas from actual experts in the field instead of from some random freshly graduated junior that's sold as a senior consultant by the contractor. It's ridiculous that many billions of dollars of taxpayer money are spent every year for proprietary software or, worse, hardware that cannot even be audited by independent third parties. A side effect of a full OSS strategy would also be that waste (e.g. ridiculous/incomplete specs, "deliverables" that don't match these specifications, unrealistic timetables) can get uncovered and tracked by the public. Given enough eyeballs and sunlight, all issues will eventually be found out. As citizens, we should demand transparency from our respective governments instead of knowing that there are issues and hope our enemies don't discover them.
- dboreham 6y ago
  Considerable wishful thinking in this imho. Even the notion that having open source reduces vulnerability probability is unproven at best.
- deleted 6y ago
  [deleted]
- thinkmassive 6y ago
  USAF has been running the Platform One project along these lines, and other military branches are following in their footsteps. https://software.af.mil/dsop/services/ https://software.af.mil/dsop/services/
- lucas_membrane 6y ago
  > sizeable bug bounties Bug bounties might work if one could be sure that the availability of the bounties was not a significant incentive for creation of the bugs. Demand finds more ways to drive supply than you or I can imagine.
- wffurr 6y ago
  We can't even get the NSA, an agency of our own government, to meaningfully contribute to cyberdefense, because they're too focused on offense. (See TFA) I don't see how paying $100k bug bounties and requiring open source can even make a dent when the same government is paying $millions on cyber offense.
tomjen3 6y ago
Most security flaws that I have seen seems to fall into two separate groups: trusting user input and leaking timing information. If we worked on a system to whitelist proven safe input, then we would be a lot safer. What interests me is that we are essentially in an opposite of WWI: attacking is extremely easy, defense is very hard. I am not sure that this helps, but perhaps that can give some suggestions.
AzzieElbab 6y ago
Perfect cyber defence is impossible. Getting rid of password protected backdoors is possible, applying security patches in timely manner is even more possible. There, two biggest hacks in the last few years just became impossible. People are not doing their jobs and hide behind the “impossible”
- TrueDuality 6y ago
  I'd argue that it has nothing to do with people not doing their jobs but rather the companies are accepting the risk of these breaches instead of providing the necessary resources to protect themselves. It could be argued we're saying the same thing, but your statement has subtle undertones of "IT is failing to do what they're paid to do" instead of the reality of "executives and board members are focused on absolute profit and don't have any legal or financial consequences to being hacked". Most C-levels that have left "as a result of a breach" for the incidents in the past decade do so with a massive golden parachute. Then after a vacation go work for another company with no consequences. They're actively rewarded for this behavior right now.
  - AzzieElbab 6y ago
    As an engineer you do your job first and foremost, you blame your your management when they do not let you to do your job.
- wffurr 6y ago
  What are the two biggest hacks that are now impossible? Certainly none of our big C++ platform software has really made any headway on completely removing memory security bugs.
  - AzzieElbab 6y ago
    solar winds clients were hacked through solar winds back door and equifax was hacked though outdated version of struts framework
    - 6y ago

by wffurr 6y ago

mschuster91 6y ago

> So what does that leave? Hope? Not much of a strategy. Open Source everything that is IT in government - from the basic design specifications to actual infrastructure configuration - and pay sizeable bug bounties (to the tune of at least 100k per bug) to incentivize third party experts is a very valid strategy. It is also a great way to get contributions/feedback for improvement ideas from actual experts in the field instead of from some random freshly graduated junior that's sold as a senior consultant by the contractor. It's ridiculous that many billions of dollars of taxpayer money are spent every year for proprietary software or, worse, hardware that cannot even be audited by independent third parties. A side effect of a full OSS strategy would also be that waste (e.g. ridiculous/incomplete specs, "deliverables" that don't match these specifications, unrealistic timetables) can get uncovered and tracked by the public. Given enough eyeballs and sunlight, all issues will eventually be found out. As citizens, we should demand transparency from our respective governments instead of knowing that there are issues and hope our enemies don't discover them.

dboreham 6y ago
Considerable wishful thinking in this imho. Even the notion that having open source reduces vulnerability probability is unproven at best.
deleted 6y ago
[deleted]
thinkmassive 6y ago
USAF has been running the Platform One project along these lines, and other military branches are following in their footsteps. https://software.af.mil/dsop/services/ https://software.af.mil/dsop/services/
lucas_membrane 6y ago
> sizeable bug bounties Bug bounties might work if one could be sure that the availability of the bounties was not a significant incentive for creation of the bugs. Demand finds more ways to drive supply than you or I can imagine.
wffurr 6y ago
We can't even get the NSA, an agency of our own government, to meaningfully contribute to cyberdefense, because they're too focused on offense. (See TFA) I don't see how paying $100k bug bounties and requiring open source can even make a dent when the same government is paying $millions on cyber offense.

tomjen3 6y ago

Most security flaws that I have seen seems to fall into two separate groups: trusting user input and leaking timing information. If we worked on a system to whitelist proven safe input, then we would be a lot safer. What interests me is that we are essentially in an opposite of WWI: attacking is extremely easy, defense is very hard. I am not sure that this helps, but perhaps that can give some suggestions.

AzzieElbab 6y ago

Perfect cyber defence is impossible. Getting rid of password protected backdoors is possible, applying security patches in timely manner is even more possible. There, two biggest hacks in the last few years just became impossible. People are not doing their jobs and hide behind the “impossible”

TrueDuality 6y ago
I'd argue that it has nothing to do with people not doing their jobs but rather the companies are accepting the risk of these breaches instead of providing the necessary resources to protect themselves. It could be argued we're saying the same thing, but your statement has subtle undertones of "IT is failing to do what they're paid to do" instead of the reality of "executives and board members are focused on absolute profit and don't have any legal or financial consequences to being hacked". Most C-levels that have left "as a result of a breach" for the incidents in the past decade do so with a massive golden parachute. Then after a vacation go work for another company with no consequences. They're actively rewarded for this behavior right now.
- AzzieElbab 6y ago
  As an engineer you do your job first and foremost, you blame your your management when they do not let you to do your job.
wffurr 6y ago
What are the two biggest hacks that are now impossible? Certainly none of our big C++ platform software has really made any headway on completely removing memory security bugs.
- AzzieElbab 6y ago
  solar winds clients were hacked through solar winds back door and equifax was hacked though outdated version of struts framework
  - 6y ago