4 ms·

That's some seriously scary (and concerning) stuff. As a non technical person, what are some things I can do to protect my company against complex cyber adversa

That's some seriously scary (and concerning) stuff. As a non technical person, what are some things I can do to protect my company against complex cyber adversaries? Also, considering the destructive potential of those cyber weapons, are there any international laws surrounding the usage of them against civilian targets?

ChuckNorris89 5y ago
>what are some things I can do to protect my company against complex cyber adversaries? Employ on site Red and Blue teams or pay externals for regular penetration tests and security audits that feed back results to your site/infra/dev-ops teams. None of this is new but most businesses ignore them since it's seen as an expensive snake oil and most importantly, "it's never gonna happen to me".
- citrin_ru 5y ago
  > it's never gonna happen to me Or they see that multiple Fortune 500 companies were affected by breaches and all of them are doing fine. So attitude can be - "it's inevitable, but we'll be OK anyway"
Abishek_Muthian 5y ago
>As a non technical person, what are some things I can do to protect my company against complex cyber adversaries? That usually comes down to - who are your adversaries? Parent implies that given enough money, high value targets can be compromised for less money than conventional military arsenal. For an average individual, small company dealing with non-sensitive data - preventing non-targeted attacks is likely high priority e.g. Preventing your applications, data from getting compromised because its vulnerability was detected in the random scan of the attacker (or) your staff plugged in a flash drive with ransomware. Some simple non-exhaustive preventive measures are - Operational Security(Training staffs to not click unwanted links, social engineering attacks(not to reveal too much about their work online, Better identity management etc.) Application Security(Ensuring security focused application development, keeping up-to date with the patches for libraries etc.), Collecting less customer data as possible(Ensuring customer privacy).
wepple 5y ago
What’s your budget & what are you protecting? Without that info, I think one of the only universal recommendations (whether you’re a trillion dollar FAANG or 2 person startup) is buy U2F keys for everyone* and enable them everywhere. Also try to know what assets you have, and patch everything regularly. * yubico make great U2F keys which I recommend. Others such as google also make keys
devit 5y ago
Don't connect anything critical to any network, directly or indirectly, except a dedicated one separate from the Internet if unavoidable. Never browse the web, read e-mail or otherwise run any Internet client from any machine with data on it and instead use a separate machine or if unavoidable a VM on top of a reasonably secure hypervisor to run the browser. Secure every single systems assuming that the network is compromised. Restrict access data to only those who need it. Avoid software written in C/C++ for anything security critical at all costs unless there is no alternative. Only hire competent programmers and sysadmins. Invest in proper physical security.
yabones 5y ago
Defence in depth. It's not a buzzword anymore, but the principals hold up. Basically, each component in your threat model should have no less than two controls to protect it. Assume that 'active' systems (antivirus etc) can and will fail. Passive measures are predictable and cost effective, but have limitations - a mixture of both is ideal. Think of it like a well fortified house. You don't just stick a robotic machine gun on the roof and command it to shoot people it doesn't recognize - everybody knows from intuition that's a bad idea. Instead, you layer up your defences. Passive measures are a great start: a steel door, bars in the windows, bollards to keep vehicles away, etc. Then you layer active measures: lights and cameras, sensors in windows and doors, keycard access to different areas, etc. Anything more than that you need to develop your threat model; are you defending against bears or against a helicopter gunship? A moat won't protect you from a chopper, and radar guided anti-aircraft missiles won't be very effective against bears.
Veserv 5y ago
About the only commercially available solution that provides defense against attackers with more than $1-10M is a system that is inaccessible to a remote attacker. As a company this means complete physical disconnection of the systems you want to use in addition to a complete removal of all possible connectors except for a very limited set of explicitly enumerated entry points that you add back onto a system that is completely physically disconnected. To evaluate the quality of your security, you should hire a red team, a team that emulates an attacker, to attempt to breach your security. If they are able to breach your systems then the key takeaway is that your security process is systemically incapable of defending against attackers with that level of budget and resources which is supported by the empirical evidence that a team with that level of budget and resources did, in fact, breach your systems. This is in contrast to the standard takeaway which is to just fix the specific defects discovered since obviously the only defects that exist are specifically in the areas that were probed. To actually remediate the problem you need a systemic overhaul otherwise you will just keep getting the same quality of output that is equally defective. Unfortunately, the prevailing state of cybersecurity has no functional solutions to these problems once you get to attackers with a few million dollars outside of the heavy-handed and highly inconvenient solution of disconnection. For systems with safety standards, that is a cost that should be paid. For any other system, you need to evaluate if disconnection is worth it in the context that there is a 100% chance that anybody with a few million dollars can successfully completely compromise your systems. If you only consider direct harms such as monetary damages, disruption of business, stock price changes, it is highly unlikely to be worth it compared to getting insurance at this time as most attacks that do direct harm are still being done by financially unsophisticated attackers who are still underutilizing their blackmail potential by at least 10-100x, so it is almost always financially prudent to just eat the cost. As for indirect effects, it is up to you to consider if IP loss, reputation loss, leakage of confidential information, etc. at the cost of a few million dollars is worse than the negative effects of disconnecting.

ChuckNorris89 5y ago

>what are some things I can do to protect my company against complex cyber adversaries? Employ on site Red and Blue teams or pay externals for regular penetration tests and security audits that feed back results to your site/infra/dev-ops teams. None of this is new but most businesses ignore them since it's seen as an expensive snake oil and most importantly, "it's never gonna happen to me".

citrin_ru 5y ago
> it's never gonna happen to me Or they see that multiple Fortune 500 companies were affected by breaches and all of them are doing fine. So attitude can be - "it's inevitable, but we'll be OK anyway"

Abishek_Muthian 5y ago

>As a non technical person, what are some things I can do to protect my company against complex cyber adversaries? That usually comes down to - who are your adversaries? Parent implies that given enough money, high value targets can be compromised for less money than conventional military arsenal. For an average individual, small company dealing with non-sensitive data - preventing non-targeted attacks is likely high priority e.g. Preventing your applications, data from getting compromised because its vulnerability was detected in the random scan of the attacker (or) your staff plugged in a flash drive with ransomware. Some simple non-exhaustive preventive measures are - Operational Security(Training staffs to not click unwanted links, social engineering attacks(not to reveal too much about their work online, Better identity management etc.) Application Security(Ensuring security focused application development, keeping up-to date with the patches for libraries etc.), Collecting less customer data as possible(Ensuring customer privacy).

wepple 5y ago

What’s your budget & what are you protecting? Without that info, I think one of the only universal recommendations (whether you’re a trillion dollar FAANG or 2 person startup) is buy U2F keys for everyone* and enable them everywhere. Also try to know what assets you have, and patch everything regularly. * yubico make great U2F keys which I recommend. Others such as google also make keys

devit 5y ago

Don't connect anything critical to any network, directly or indirectly, except a dedicated one separate from the Internet if unavoidable. Never browse the web, read e-mail or otherwise run any Internet client from any machine with data on it and instead use a separate machine or if unavoidable a VM on top of a reasonably secure hypervisor to run the browser. Secure every single systems assuming that the network is compromised. Restrict access data to only those who need it. Avoid software written in C/C++ for anything security critical at all costs unless there is no alternative. Only hire competent programmers and sysadmins. Invest in proper physical security.

yabones 5y ago

Defence in depth. It's not a buzzword anymore, but the principals hold up. Basically, each component in your threat model should have no less than two controls to protect it. Assume that 'active' systems (antivirus etc) can and will fail. Passive measures are predictable and cost effective, but have limitations - a mixture of both is ideal. Think of it like a well fortified house. You don't just stick a robotic machine gun on the roof and command it to shoot people it doesn't recognize - everybody knows from intuition that's a bad idea. Instead, you layer up your defences. Passive measures are a great start: a steel door, bars in the windows, bollards to keep vehicles away, etc. Then you layer active measures: lights and cameras, sensors in windows and doors, keycard access to different areas, etc. Anything more than that you need to develop your threat model; are you defending against bears or against a helicopter gunship? A moat won't protect you from a chopper, and radar guided anti-aircraft missiles won't be very effective against bears.

Veserv 5y ago

About the only commercially available solution that provides defense against attackers with more than $1-10M is a system that is inaccessible to a remote attacker. As a company this means complete physical disconnection of the systems you want to use in addition to a complete removal of all possible connectors except for a very limited set of explicitly enumerated entry points that you add back onto a system that is completely physically disconnected. To evaluate the quality of your security, you should hire a red team, a team that emulates an attacker, to attempt to breach your security. If they are able to breach your systems then the key takeaway is that your security process is systemically incapable of defending against attackers with that level of budget and resources which is supported by the empirical evidence that a team with that level of budget and resources did, in fact, breach your systems. This is in contrast to the standard takeaway which is to just fix the specific defects discovered since obviously the only defects that exist are specifically in the areas that were probed. To actually remediate the problem you need a systemic overhaul otherwise you will just keep getting the same quality of output that is equally defective. Unfortunately, the prevailing state of cybersecurity has no functional solutions to these problems once you get to attackers with a few million dollars outside of the heavy-handed and highly inconvenient solution of disconnection. For systems with safety standards, that is a cost that should be paid. For any other system, you need to evaluate if disconnection is worth it in the context that there is a 100% chance that anybody with a few million dollars can successfully completely compromise your systems. If you only consider direct harms such as monetary damages, disruption of business, stock price changes, it is highly unlikely to be worth it compared to getting insurance at this time as most attacks that do direct harm are still being done by financially unsophisticated attackers who are still underutilizing their blackmail potential by at least 10-100x, so it is almost always financially prudent to just eat the cost. As for indirect effects, it is up to you to consider if IP loss, reputation loss, leakage of confidential information, etc. at the cost of a few million dollars is worse than the negative effects of disconnecting.