4 ms·

I think the most important thing the SolarWinds hack has revealed is that the massive pile of paperwork that has to be filled out, full of security controls, to

by bane 6y ago

I think the most important thing the SolarWinds hack has revealed is that the massive pile of paperwork that has to be filled out, full of security controls, to accredit system for government systems, is fairly useless. It's the digital equivalent of the Great Wall of China. Designed by bureaucrats, impressive in size, a massive effort, and ultimately not going to stop the Mongols anyways. Security paperwork is not security. More important I think is that the months and months it takes to usher things through the process forces things to be out of date which in itself creates security problems. An actual audit of the source code + running it in an instrumented live test environment to capture behavior is far better.

asperous 6y ago
They didn’t prevent this specific hack so they are completely useless?
- DecoPerson 6y ago
  They didn’t say “completely useless,” they said “fairly useless.” If you look at this case even briefly, you should come to the conclusion that the “security paperwork” is fairly useless. An FTP server compromised because of a terrible password policy? No suspicious activity alerts of any kind? Executives who (based on their comments) are clearly ignorant of what makes software actually secure? What is the paperwork able to prevent, if it can’t prevent such fundamental problems?
  - bane 6y ago
    Exactly. It's wonderful that there's a few thousand controls for things like password length. But things that cause massive security nightmares like "does the CTO care about security?" or "has a pentest team reviewed and audited the source?" are so fundamental and should be triggered as any new system touches more and more systems. "Does this software touch literally every other system on the network?" should be a question that triggers a much more rigorous and deeply technical evaluation and review. But the current processes don't work that way, they purely paperwork drills that often demonstrably make systems less safe.

by bane 6y ago

asperous 6y ago

They didn’t prevent this specific hack so they are completely useless?

DecoPerson 6y ago
They didn’t say “completely useless,” they said “fairly useless.” If you look at this case even briefly, you should come to the conclusion that the “security paperwork” is fairly useless. An FTP server compromised because of a terrible password policy? No suspicious activity alerts of any kind? Executives who (based on their comments) are clearly ignorant of what makes software actually secure? What is the paperwork able to prevent, if it can’t prevent such fundamental problems?
- bane 6y ago
  Exactly. It's wonderful that there's a few thousand controls for things like password length. But things that cause massive security nightmares like "does the CTO care about security?" or "has a pentest team reviewed and audited the source?" are so fundamental and should be triggered as any new system touches more and more systems. "Does this software touch literally every other system on the network?" should be a question that triggers a much more rigorous and deeply technical evaluation and review. But the current processes don't work that way, they purely paperwork drills that often demonstrably make systems less safe.