4 ms·

Perfect cyber defence is impossible. Getting rid of password protected backdoors is possible, applying security patches in timely manner is even more possible.

Perfect cyber defence is impossible. Getting rid of password protected backdoors is possible, applying security patches in timely manner is even more possible. There, two biggest hacks in the last few years just became impossible. People are not doing their jobs and hide behind the “impossible”

TrueDuality 6y ago
I'd argue that it has nothing to do with people not doing their jobs but rather the companies are accepting the risk of these breaches instead of providing the necessary resources to protect themselves. It could be argued we're saying the same thing, but your statement has subtle undertones of "IT is failing to do what they're paid to do" instead of the reality of "executives and board members are focused on absolute profit and don't have any legal or financial consequences to being hacked". Most C-levels that have left "as a result of a breach" for the incidents in the past decade do so with a massive golden parachute. Then after a vacation go work for another company with no consequences. They're actively rewarded for this behavior right now.
- AzzieElbab 6y ago
  As an engineer you do your job first and foremost, you blame your your management when they do not let you to do your job.
wffurr 6y ago
What are the two biggest hacks that are now impossible? Certainly none of our big C++ platform software has really made any headway on completely removing memory security bugs.
- AzzieElbab 6y ago
  solar winds clients were hacked through solar winds back door and equifax was hacked though outdated version of struts framework
  - wffurr 6y ago
    Those types of attacks are absolutely still possible. I am less interested in specific attacks and more in closing out entire types of attacks.
    - AzzieElbab 6y ago
      That is very commendable goal, but shouldn’t we stay diligent in the meanwhile?
      - wffurr 6y ago
        Sure, but it doesn't seem relevant to playing defense. Patching after an attack is a losing battle. Real defense is securing systems in advance.

TrueDuality 6y ago

I'd argue that it has nothing to do with people not doing their jobs but rather the companies are accepting the risk of these breaches instead of providing the necessary resources to protect themselves. It could be argued we're saying the same thing, but your statement has subtle undertones of "IT is failing to do what they're paid to do" instead of the reality of "executives and board members are focused on absolute profit and don't have any legal or financial consequences to being hacked". Most C-levels that have left "as a result of a breach" for the incidents in the past decade do so with a massive golden parachute. Then after a vacation go work for another company with no consequences. They're actively rewarded for this behavior right now.

AzzieElbab 6y ago
As an engineer you do your job first and foremost, you blame your your management when they do not let you to do your job.

wffurr 6y ago

What are the two biggest hacks that are now impossible? Certainly none of our big C++ platform software has really made any headway on completely removing memory security bugs.

AzzieElbab 6y ago
solar winds clients were hacked through solar winds back door and equifax was hacked though outdated version of struts framework
- wffurr 6y ago
  Those types of attacks are absolutely still possible. I am less interested in specific attacks and more in closing out entire types of attacks.
  - AzzieElbab 6y ago
    That is very commendable goal, but shouldn’t we stay diligent in the meanwhile?
    - wffurr 6y ago
      Sure, but it doesn't seem relevant to playing defense. Patching after an attack is a losing battle. Real defense is securing systems in advance.