3 ms·

You say this as if a disgruntled employee can't compromise the security of literally any system at all. Remember Snowden didn't hack the CIA. He just worked th

by slver 5y ago

You say this as if a disgruntled employee can't compromise the security of literally any system at all. Remember Snowden didn't hack the CIA. He just worked there. And has a user/pass.

throwawaygh 5y ago
Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously.
- JadeNB 5y ago
  > Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously. How do you protect yourself? There are ways to mitigate, surely, but any failure can be a catastrophic incident, and it is literally impossible to protect against all internal threats (in the sense of guaranteeing that no such threat is ever acted upon). All else aside, it just shifts the responsibility one level up: now you have to worry about a compromise of the people responsible for protecting from internal threats.
  - throwawaygh 5y ago
    Security is hard, and the difficulty of answering this question in any particular org probably takes up a lot of the time of any competent and properly staffed CISO office. But, basically, the only mechanisms in play are some combination of limiting access and, where that's not possible, decreasing employees' ability/incentive to defect.
    - slver 5y ago
      This is a bit like the question how to have a system that promotes honest, smart politicians. As you might guess, nobody has figured that out yet. Ultimately the only way is an omniscient, omnipresent CEO who does all the important stuff alone. Which is probably the core reason why no one has leaked God's files on the Universe, yet.
      - throwawaygh 5y ago
        Yes, it's EXACTLY like that. Perfection is impossible, but that's also no argument for repealing sunshine laws or legalizing outright bribery. You're letting perfect be the enemy of better.
        slver 5y ago
        Oh yeah let's talk about how perfect is the enemy of better, when discussing an idea to bury victims of ransomware into the ground with government penalties on top of ransom and leaks. Here's another thought in the same vein: let's penalize rape victims for attracting male gaze and not fighting sufficiently to avert contact. Sure, some women will get raped still, but let's not let perfect be the enemy of better. That's how they deal with it in some countries actually. They blame the victim. It doesn't reduce rape at all. In fact it reduces reported rape, because women don't want to face the legal and family repercussions of getting raped. Let me tell you what will happen in the case of ransomware. 1. You get hit by ransomware. 2. Previously you'd ponder contacting authorities. Nope. They're gonna close your options and fine you either way. Keep your mouth shut. 3. Pay as quickly as possible and hope the word never comes out you were blackmailed at all. As far as the world and the government know, your security is fine, nothing happened. No fines, no lawsuits. 4. Result: ransomware proliferates and grows into the biggest organized crime organizations of this century. How's that about not letting perfect be the enemy of better?
- slver 5y ago
  We must protect ourselves against insiders. Let's hire some insiders to do it. Ah, shit.
  - throwawaygh 5y ago
    ...In most cases, the CEO and probably a huge number of people in upper management can do any number of things to nuke a company from orbit. But this doesn't happen very often. The things that those people can do to nuke a company from orbit are typically tightly controlled functions, and the people with those responsibilities are carefully selected and extremely well-compensated. Yes, some employees need to be absolutely trusted. No, you don't need to absolutely trust every employee (or even most employees). Turning to your Snowden example, if you're a TLA and find yourself completely owned by an outside contractor making low six fiures, then you've utterly failed and managing insider risk.
- lghh 5y ago
  But _somebody_ has to have clearance to get to the data in some way. You can't protect yourself against that person. It's not possible.
adrianN 5y ago
If disgruntled employees were the main actors stealing user data I'd feel a lot better about the state of IT security.
- slver 5y ago
  Think carefully if you care how someone stole the data. Or you care more about how likely it is to steal the data. I can argue that penalizing companies for being blackmailed in fact encourages less cooperation with authorities, which encourages more people to blackmail them

by slver 5y ago

You say this as if a disgruntled employee can't compromise the security of literally any system at all. Remember Snowden didn't hack the CIA. He just worked there. And has a user/pass.

throwawaygh 5y ago

Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously.

JadeNB 5y ago
> Part of a good security posture is protecting yourself against insider threats. If you're not doing this, you're not taking cybersecurity seriously. How do you protect yourself? There are ways to mitigate, surely, but any failure can be a catastrophic incident, and it is literally impossible to protect against all internal threats (in the sense of guaranteeing that no such threat is ever acted upon). All else aside, it just shifts the responsibility one level up: now you have to worry about a compromise of the people responsible for protecting from internal threats.
- throwawaygh 5y ago
  Security is hard, and the difficulty of answering this question in any particular org probably takes up a lot of the time of any competent and properly staffed CISO office. But, basically, the only mechanisms in play are some combination of limiting access and, where that's not possible, decreasing employees' ability/incentive to defect.
  - slver 5y ago
    This is a bit like the question how to have a system that promotes honest, smart politicians. As you might guess, nobody has figured that out yet. Ultimately the only way is an omniscient, omnipresent CEO who does all the important stuff alone. Which is probably the core reason why no one has leaked God's files on the Universe, yet.
    - throwawaygh 5y ago
      Yes, it's EXACTLY like that. Perfection is impossible, but that's also no argument for repealing sunshine laws or legalizing outright bribery. You're letting perfect be the enemy of better.
      - slver 5y ago
        Oh yeah let's talk about how perfect is the enemy of better, when discussing an idea to bury victims of ransomware into the ground with government penalties on top of ransom and leaks. Here's another thought in the same vein: let's penalize rape victims for attracting male gaze and not fighting sufficiently to avert contact. Sure, some women will get raped still, but let's not let perfect be the enemy of better. That's how they deal with it in some countries actually. They blame the victim. It doesn't reduce rape at all. In fact it reduces reported rape, because women don't want to face the legal and family repercussions of getting raped. Let me tell you what will happen in the case of ransomware. 1. You get hit by ransomware. 2. Previously you'd ponder contacting authorities. Nope. They're gonna close your options and fine you either way. Keep your mouth shut. 3. Pay as quickly as possible and hope the word never comes out you were blackmailed at all. As far as the world and the government know, your security is fine, nothing happened. No fines, no lawsuits. 4. Result: ransomware proliferates and grows into the biggest organized crime organizations of this century. How's that about not letting perfect be the enemy of better?
slver 5y ago
We must protect ourselves against insiders. Let's hire some insiders to do it. Ah, shit.
- throwawaygh 5y ago
  ...In most cases, the CEO and probably a huge number of people in upper management can do any number of things to nuke a company from orbit. But this doesn't happen very often. The things that those people can do to nuke a company from orbit are typically tightly controlled functions, and the people with those responsibilities are carefully selected and extremely well-compensated. Yes, some employees need to be absolutely trusted. No, you don't need to absolutely trust every employee (or even most employees). Turning to your Snowden example, if you're a TLA and find yourself completely owned by an outside contractor making low six fiures, then you've utterly failed and managing insider risk.
lghh 5y ago
But _somebody_ has to have clearance to get to the data in some way. You can't protect yourself against that person. It's not possible.

adrianN 5y ago

If disgruntled employees were the main actors stealing user data I'd feel a lot better about the state of IT security.

slver 5y ago
Think carefully if you care how someone stole the data. Or you care more about how likely it is to steal the data. I can argue that penalizing companies for being blackmailed in fact encourages less cooperation with authorities, which encourages more people to blackmail them