7 ms·

The problem is that on-prem isn't much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats w

The problem is that on-prem isn't much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats whether it's the cloud, or the on-prem. If you and your team have the skills you can operate fairly effectively on a small scale, but that's a pretty luxurious situation. Most home users can't tell the difference between a router and cable modem hence it's in the interest of cable providers to lower support costs by providing a managed offering. It's terrible from a security perspective, but customers have signed that away. The common theme running through these breaches is that the organization isn't necessarily small, but they aren't Google/Apple/Microsoft-size either. Those companies have multiple layers of expertise and the cash flow to hold up development of anything in order to make sure things are secure. It's hard to wing stuff once the bureaucracy understands security is needed. They even start pushing their product security initiatives outside of product development to mundane departments because they get attacked by very smart actors. You can see from the news it's still far from perfect. Once you get to companies the size of Ubiquiti, you start having challenges with implementing close to the same degree of security because you don't have float in the system to allow for additional costs, delays, etc. on top of the lack of expertise. Apparently Ubiquiti have been hemorrhaging expertise in other areas due to opportunistic cost-cutting, so it isn't a surprise that they suffer and respond in this way given that culture. A bad security decision by one exec in companies of this size can cut across many departments which doesn't happen in the behemoths.

pseudalopex 6y ago
The problem isn't Ubiquiti using AWS. It's Ubquiti forcing customers to use cloud authentication.
- arbitrage 6y ago
  Let's be honest, there are a lot of problems here.
- zerkten 6y ago
  I didn't make the claim that there is a problem with Ubiquiti using AWS. The problem is that the conditions exist for Ubiquiti to fail with cloud authentication. If hadn't failed with that it'd have failed in another way. Perhaps that failing wouldn't have been as bad in other cases, but we already see how their products have declined for the same reasons.
  - pseudalopex 6y ago
    Without cloud authentication the only way to mass compromise Ubiquiti devices would be to compromise software updates. Which companies do a better job securing usually.
xoa 6y ago
>The problem is that on-prem isn't much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats whether it's the cloud, or the on-prem. One of the truly sad things about all this though is precisely that UniFi made this a lot easier for small orgs and even individuals (and could have gone even farther). Stuff like VLANs and RADIUS became dramatically more accessible "for free", using just what was built-in to a UniFi stack someone might get anyway. Back when they were still more competent Ubiquiti added management VLAN support across the lineup, and the setup is fairly intuitive and then just works. At one point I'd hoped they'd continue in that direction much more. It's not some impossible thing, it mainly just needs better UX putting the pieces together in a graspable way. Graphical VLAN topologies and point-and-click, automating all the certificate authentication/signing stuff, the generation of profiles for onboarding, all the components for this stuff exist right now just not, well, unified. I think a lot of places don't want to in fact, because they'd rather push cloud ties since that can yield subscription revenue.
dec0dedab0de 6y ago
on-prem is much better in most cases because if there is a bug an attacker would have to scan the internet and find you before a patch is released and you update. If that bug is only accessible from inside of your network to begin with, then that means the attacker would already have to be inside your network. As far as the team having skills, there is not much that ubiquity does that can't be handled on prem, I mean you're already installing physical devices, how much more effort is it to install a controller? Sure, that means you're on the hook for upgrades, but in most cases you're better off not getting them instantly anyway. And to clarify my point about ISP gear, I agree that the average user can't be expected to understand or care. I meant so called technical users.
- andsens 6y ago
  > on-prem is much better in most cases Counterpoint: https://en.wikipedia.org/wiki/2021_Microsoft_Exchange_Server_data_breach https://en.wikipedia.org/wiki/2021_Microsoft_Exchange_Server...

pseudalopex 6y ago

The problem isn't Ubiquiti using AWS. It's Ubquiti forcing customers to use cloud authentication.

arbitrage 6y ago
Let's be honest, there are a lot of problems here.
zerkten 6y ago
I didn't make the claim that there is a problem with Ubiquiti using AWS. The problem is that the conditions exist for Ubiquiti to fail with cloud authentication. If hadn't failed with that it'd have failed in another way. Perhaps that failing wouldn't have been as bad in other cases, but we already see how their products have declined for the same reasons.
- pseudalopex 6y ago
  Without cloud authentication the only way to mass compromise Ubiquiti devices would be to compromise software updates. Which companies do a better job securing usually.

xoa 6y ago

>The problem is that on-prem isn't much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats whether it's the cloud, or the on-prem. One of the truly sad things about all this though is precisely that UniFi made this a lot easier for small orgs and even individuals (and could have gone even farther). Stuff like VLANs and RADIUS became dramatically more accessible "for free", using just what was built-in to a UniFi stack someone might get anyway. Back when they were still more competent Ubiquiti added management VLAN support across the lineup, and the setup is fairly intuitive and then just works. At one point I'd hoped they'd continue in that direction much more. It's not some impossible thing, it mainly just needs better UX putting the pieces together in a graspable way. Graphical VLAN topologies and point-and-click, automating all the certificate authentication/signing stuff, the generation of profiles for onboarding, all the components for this stuff exist right now just not, well, unified. I think a lot of places don't want to in fact, because they'd rather push cloud ties since that can yield subscription revenue.

dec0dedab0de 6y ago

on-prem is much better in most cases because if there is a bug an attacker would have to scan the internet and find you before a patch is released and you update. If that bug is only accessible from inside of your network to begin with, then that means the attacker would already have to be inside your network. As far as the team having skills, there is not much that ubiquity does that can't be handled on prem, I mean you're already installing physical devices, how much more effort is it to install a controller? Sure, that means you're on the hook for upgrades, but in most cases you're better off not getting them instantly anyway. And to clarify my point about ISP gear, I agree that the average user can't be expected to understand or care. I meant so called technical users.

andsens 6y ago
> on-prem is much better in most cases Counterpoint: https://en.wikipedia.org/wiki/2021_Microsoft_Exchange_Server_data_breach https://en.wikipedia.org/wiki/2021_Microsoft_Exchange_Server...