3 ms·

Almost every concrete way to manifest "building a business focused internet" is something that the businesses can already do, today. They aren't doing it. It d

by jerf 5y ago

Almost every concrete way to manifest "building a business focused internet" is something that the businesses can already do, today. They aren't doing it. It doesn't do any good if your secretary needs access to the "business focused internet" and also has to get mail from the "normal" internet. The transitive nature of networks makes things very hard to isolate in practice. People and businesses are going to have to accept a lot more inconvenience to isolate things better, and that inconvenience is real money, too. The problem is you end up with yet another manifestation of a common business problem; if you take the time and money to build a secure business, that carefully isolates everything correctly, that hires good security engineers, that accepts higher costs of doing business, you'll be in a position to handle a cyberpocalypse better than your competitors and you will reap the benefits when that day comes. The problem is, you'll never survive to see that day come because you'll have been utterly outcompeted by your competition that cut corners and carelessly, but effectively, integrated their systems, and over-optimized their internal systems to function more cheaply day-by-day. You may have taken the time to build on the rock while they threw shacks up on the sand but they end up killing you before the storm comes.

Animats 5y ago
The first step is reliable backups. Preferably to write-once media. And both onsite and offsite. Hard backups aren't expensive. Not of everything. Just the important stuff. Maybe a snapshot of the whole business once a month in addition to transaction backups. Any business doing financial transactions should be backing them up to something like Blu-Ray disks. Preferably the blanks with the 1000-year lifetime. US banks are already required to do something like that, by the FDIC.
- worik 5y ago
  That is much harder than it sounds. For one thing backups are no use if you do not test them. How often are you going to bring your systems down to test restorinig from backup? If you do not how do you know they work?
  - viraptor 5y ago
    You don't need to restore over your existing production. (Since it's literally a "will it work" test) You do that on a temporary environment.
  - corty 5y ago
    Also, even provided you have known-good backups from the time before an attack occured: restore takes time, for a whole-company-restore in the order of several weeks to several months. Can your business survive that long without doing anything?
- PeterisP 5y ago
  Okay, let's assume that you have a bunch of Blu-ray disks with backups of your databases - for a round number suitable for some enterprise, let's assume a hundred separate systems, but you want to restore just the important stuff, so a dozen of them. How do you do that if all your infrastructure is toast? Also, how do you restore a cluster of interconnected systems from different vendors? I mean, all of that is done, but it's far from easy or trivial, and if you're not properly prepared, backups alone aren't enough as it'll take a lot of time and work until you have the systems functional and properly interconnected so what you can restore the data to them. Those systems aren't simply deployable overnight, and I would presume that for at least half of these systems the enterprise never ever had the capability to deploy them, the initial install was and configuration done by a combination of vendor engineers and outside consultants and took six or more months. Sure, you'll recover the data eventually, but you'd rather pay a ransom to avoid as much downtime.
unclebucknasty 5y ago
All true, and I think the solution is even harder than that. That is, even the best-intentioned and well-resourced companies would face severe headwinds in trying to "build [or rebuild] on the rock". A lot of these businesses have been around for decades and are working on mountains of technical debt. They built ad-hoc systems over the years (before security was "a thing"), employ tenuously-functioning integrations with acquired company systems and more. To make matters worse, much of the technical knowledge has walked out of the door over the years. In my consulting days it wasn't unusual to find that no one in a company really understood how systems worked (or even why). And, in some cases, they actually didn't work. I've seen billing systems that were unpredictable and relied on customers to call to report billing errors. Not a single person in the company even understood how it was supposed to work. And, these were sizable companies. Agile has only exacerbated these issues as more software is built more quickly and with scant documentation. All of that to say that it's difficult enough for many companies to build functioning software, let alone to secure it. And, the number of people who truly understand what it takes to secure networks/software is tiny relative to demand for engineers. Throw in OSS, zero-days, social engineering attacks, etc. and it starts to become clear that any realistic solution includes a regime of deterrence through aggressive responses at the nation-state level. Sure, we should require companies to do more to secure their networks/systems, educate on best practices, etc. But, it's easy to issue an off-handed "they should've been more secure" response. The reality is that many companies simply aren't. We need to appreciate the difficulty and the protracted timeline over which any hardening might happen (if at all), and deploy a multi-faceted approach that also treats the problem as the national security issue it represents.

by jerf 5y ago

Animats 5y ago

The first step is reliable backups. Preferably to write-once media. And both onsite and offsite. Hard backups aren't expensive. Not of everything. Just the important stuff. Maybe a snapshot of the whole business once a month in addition to transaction backups. Any business doing financial transactions should be backing them up to something like Blu-Ray disks. Preferably the blanks with the 1000-year lifetime. US banks are already required to do something like that, by the FDIC.

worik 5y ago
That is much harder than it sounds. For one thing backups are no use if you do not test them. How often are you going to bring your systems down to test restorinig from backup? If you do not how do you know they work?
- viraptor 5y ago
  You don't need to restore over your existing production. (Since it's literally a "will it work" test) You do that on a temporary environment.
- corty 5y ago
  Also, even provided you have known-good backups from the time before an attack occured: restore takes time, for a whole-company-restore in the order of several weeks to several months. Can your business survive that long without doing anything?
PeterisP 5y ago
Okay, let's assume that you have a bunch of Blu-ray disks with backups of your databases - for a round number suitable for some enterprise, let's assume a hundred separate systems, but you want to restore just the important stuff, so a dozen of them. How do you do that if all your infrastructure is toast? Also, how do you restore a cluster of interconnected systems from different vendors? I mean, all of that is done, but it's far from easy or trivial, and if you're not properly prepared, backups alone aren't enough as it'll take a lot of time and work until you have the systems functional and properly interconnected so what you can restore the data to them. Those systems aren't simply deployable overnight, and I would presume that for at least half of these systems the enterprise never ever had the capability to deploy them, the initial install was and configuration done by a combination of vendor engineers and outside consultants and took six or more months. Sure, you'll recover the data eventually, but you'd rather pay a ransom to avoid as much downtime.

unclebucknasty 5y ago

All true, and I think the solution is even harder than that. That is, even the best-intentioned and well-resourced companies would face severe headwinds in trying to "build [or rebuild] on the rock". A lot of these businesses have been around for decades and are working on mountains of technical debt. They built ad-hoc systems over the years (before security was "a thing"), employ tenuously-functioning integrations with acquired company systems and more. To make matters worse, much of the technical knowledge has walked out of the door over the years. In my consulting days it wasn't unusual to find that no one in a company really understood how systems worked (or even why). And, in some cases, they actually didn't work. I've seen billing systems that were unpredictable and relied on customers to call to report billing errors. Not a single person in the company even understood how it was supposed to work. And, these were sizable companies. Agile has only exacerbated these issues as more software is built more quickly and with scant documentation. All of that to say that it's difficult enough for many companies to build functioning software, let alone to secure it. And, the number of people who truly understand what it takes to secure networks/software is tiny relative to demand for engineers. Throw in OSS, zero-days, social engineering attacks, etc. and it starts to become clear that any realistic solution includes a regime of deterrence through aggressive responses at the nation-state level. Sure, we should require companies to do more to secure their networks/systems, educate on best practices, etc. But, it's easy to issue an off-handed "they should've been more secure" response. The reality is that many companies simply aren't. We need to appreciate the difficulty and the protracted timeline over which any hardening might happen (if at all), and deploy a multi-faceted approach that also treats the problem as the national security issue it represents.