4 ms·

Seems like they should invest more into cybersecurity, if someone was able to “steal” their Bitcoin and take over their infrastructure ;). But honestly, this o

Seems like they should invest more into cybersecurity, if someone was able to “steal” their Bitcoin and take over their infrastructure ;). But honestly, this only shows that IT systems are nowadays so complex that you cannot get them right and be able to truly protect you, no matter if you’re good or bad guy.

stadium 5y ago
It just takes one agent or informant on the inside to bring the whole house down.
- intrasight 5y ago
  > takes one agent or informant Only if that agent has the master keys. Strong security is about making sure that there is no master key.
  - stadium 5y ago
    I was thinking more about the soft targets and people based parts of the system, but you raise an interesting point. Zero trust systems might be solvable from a tech perspective, but zero trust organizations from a social perspective are a whole lot harder to design and enforce, maybe impossible. In accounting systems, which are targets of fraud and malfeasance (e.g. Enron), there is a "4 eyes" principle. It takes at least 2 people to change something that impacts the financials. But that can't stop 2 people from colluding. Back to the topic, if one agent or informant builds trust with one actor in the target group, and they collude or if one slip is made, it could be game over. Once the org is compromised, how do you know who to trust?
    - intrasight 5y ago
      I was thinking something along these lines. Any admin access to any critical/secure system can only be made thought a channel that will record the session. Perhaps such things exist.
- justapassenger 5y ago
  If you have single point of failure, either on technical or human level, you aren’t doing it correctly. But it’s really hard to build systems and organizations like that.
breck 5y ago
> like they should invest more into cybersecurity I would say invest more thought, less money. For example, use open source more. Minimize the amount of data and information you have that needs to be closed source. Avoid Windows. Use Gmail over Outlook. Have offline backups with sneakernet disaster planning. Get a cheap safety deposit box for storing keys. Use 2FA. There are lots of free/low cost ways to have better security.
- feu 5y ago
  > Use Gmail over Outlook. Why would you recommend this? I can understand the reasoning behind the rest of your recommendations, but not this one.
  - breck 5y ago
    AFAIK, Gmail has suffered on the order of 100x+ fewer security incidents than Outlook. However, I am unclear on the distinction between cloud Outlook and the Exchange/Outlook combo. So me saying "Outlook" may be a mistake, and the correct term may be Exchange.
- justapassenger 5y ago
  It’s not 2001 anymore. You can have both secure windows and Linux infrastructure. Telling people to just use Linux as a remedy doesn’t help. If you don’t invest into securing your Windows infra, your Linux infra will be also full of holes.
  - breck 5y ago
    In 2016, while I was still working at Microsoft, they gave us cloud engineers a separate laptop for accessing customer data (they called them SAWS, for Secure Access Workstation), because they decided that our normal everyday Windows 10 machines with root privileges could not be trusted. This was in 2016, not 2001. I do not think you can have secure Windows infrastructure today. In the future, a few years after it's fully open source, perhaps. Of course you are free to make your own bets.
jakearmitage 5y ago
https://xkcd.com/538/ https://xkcd.com/538/
dkarras 5y ago
I doubt anyone stole their bitcoins though. I assume they just transferred it out themselves and will cash out later.
- intrasight 5y ago
  I was thinking the same. But it would be hard to cover such a conspiracy.

stadium 5y ago

It just takes one agent or informant on the inside to bring the whole house down.

intrasight 5y ago
> takes one agent or informant Only if that agent has the master keys. Strong security is about making sure that there is no master key.
- stadium 5y ago
  I was thinking more about the soft targets and people based parts of the system, but you raise an interesting point. Zero trust systems might be solvable from a tech perspective, but zero trust organizations from a social perspective are a whole lot harder to design and enforce, maybe impossible. In accounting systems, which are targets of fraud and malfeasance (e.g. Enron), there is a "4 eyes" principle. It takes at least 2 people to change something that impacts the financials. But that can't stop 2 people from colluding. Back to the topic, if one agent or informant builds trust with one actor in the target group, and they collude or if one slip is made, it could be game over. Once the org is compromised, how do you know who to trust?
  - intrasight 5y ago
    I was thinking something along these lines. Any admin access to any critical/secure system can only be made thought a channel that will record the session. Perhaps such things exist.
justapassenger 5y ago
If you have single point of failure, either on technical or human level, you aren’t doing it correctly. But it’s really hard to build systems and organizations like that.

breck 5y ago

> like they should invest more into cybersecurity I would say invest more thought, less money. For example, use open source more. Minimize the amount of data and information you have that needs to be closed source. Avoid Windows. Use Gmail over Outlook. Have offline backups with sneakernet disaster planning. Get a cheap safety deposit box for storing keys. Use 2FA. There are lots of free/low cost ways to have better security.

feu 5y ago
> Use Gmail over Outlook. Why would you recommend this? I can understand the reasoning behind the rest of your recommendations, but not this one.
- breck 5y ago
  AFAIK, Gmail has suffered on the order of 100x+ fewer security incidents than Outlook. However, I am unclear on the distinction between cloud Outlook and the Exchange/Outlook combo. So me saying "Outlook" may be a mistake, and the correct term may be Exchange.
justapassenger 5y ago
It’s not 2001 anymore. You can have both secure windows and Linux infrastructure. Telling people to just use Linux as a remedy doesn’t help. If you don’t invest into securing your Windows infra, your Linux infra will be also full of holes.
- breck 5y ago
  In 2016, while I was still working at Microsoft, they gave us cloud engineers a separate laptop for accessing customer data (they called them SAWS, for Secure Access Workstation), because they decided that our normal everyday Windows 10 machines with root privileges could not be trusted. This was in 2016, not 2001. I do not think you can have secure Windows infrastructure today. In the future, a few years after it's fully open source, perhaps. Of course you are free to make your own bets.

jakearmitage 5y ago

https://xkcd.com/538/ https://xkcd.com/538/

dkarras 5y ago

I doubt anyone stole their bitcoins though. I assume they just transferred it out themselves and will cash out later.

intrasight 5y ago
I was thinking the same. But it would be hard to cover such a conspiracy.