3 ms·

>pentesting consultants...exist to help companies check a box that reduces their legal liability I get it, but that's a bit of a false dichotomy. That is, ther

>pentesting consultants...exist to help companies check a box that reduces their legal liability I get it, but that's a bit of a false dichotomy. That is, there's also valid pentesting and that's the good thing, as opposed to being attacked by criminals (bad thing). And, the purpose of standing up defenses would be to prevent successful attacks. So, if it's the successful attack that prompts those defenses, then it's already too late. The bigger point is that, in general, I'm puzzled by the constant stream of people thanking the criminals and blaming the victims after each of these attacks. I think people underestimate the complexity that has evolved over time in many company systems. Securing systems/networks is hard. Doing it retroactively with mountains of technical debt is even harder. The reality is that some of these companies don't have the wherewithal to do it and, even if they did, the timeline to getting them there would leave them vulnerable for some time. So it sounds great, but very idealistic to say "hey this will help them harden their security". The reality is we need to stop thanking the criminals and support/protect our companies/agencies with a "layer" above their own security, including via deterrence at the nation-state level.

ClumsyPilot 5y ago
"The reality is we need to ... support/protect our companies/agencies" Like how we protect them from all legal consequences of loosing private information of millions of people time after time, such as recent Equifax and Facebook cases? Or like how we allow companies to sell vulnerable routers, IP cameras, internet enables printers and phones with knows vulnerabilities at the time of release, and leave it without updates? they are getting away with murder and you are asking for more protection for them? Maybe it's time to accept that this industry is greedy, arrogant and negligent in a way that's unmatched by almost anyone, except maybe hedgefunds.
- unclebucknasty 5y ago
  >Maybe it's time to accept that this industry is greedy, arrogant and negligent in a way that's unmatched by almost anyone, except maybe hedgefunds. "This industry"? Which industry is that? I mean, it's a tempting narrative: a big greedy industry, etc. But, this is not isolated to any one industry or any one company. These are attacks by foreign actors on a variety of our companies, government agencies, infrastructure, etc. And they result in real harm to our economy, infrastructure, and people. >allow companies to sell vulnerable routers, IP cameras, internet enables printers and phones with knows vulnerabilities at the time of release, and leave it without updates Again, this sounds like a compelling narrative, and sure, there need to be improvements. But, the reality is that the attack surface is vast and includes zero-days in well-maintained software, social engineering, OSS, custom software, network configs, etc. In general, it seems like there's a lot of anger in your post, but none of it directed at the actual criminals (or their national sponsors) who are actually responsible for the attacks. That's really puzzling to the point where it almost reads like defending the criminals.
  - ClumsyPilot 5y ago
    "These are attacks by foreign actors" We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate "none of it directed at the actual criminals" There will always be criminals. If a bank was robbed by two kids armed with a banana, then the real fault lies with the bank's management for being negligent, and every court will recognise it. As it stands, most data leaks and hacks are not unpreventable zerodays, they are people being negligent and irreaponsible. Large organisations need to change, and ignorance of the issue needs to be adressed. This is not just "there need to be some minor improvements"
    - unclebucknasty 5y ago
      >We have plenty of our own hackers and ransomware The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here. >i am not seeing how foreign-angle adds anything to the debate Of course, it has everything to do with the debate. Specifically, with how we respond/deter. >most data leaks and hacks are ... people being negligent and irreaponsible. The attack surface is vast. >If a bank was robbed by two kids armed with a banana We're literally veering into cartoon territory here. Not sure I understand why you're working so hard to exonerate the actual criminals.
      - ClumsyPilot 5y ago
        "most notable attacks have been traced near-exclusively to foreign actors" Most criminals are "foreign" because most of Earth's population is foreign. "The attack surface is vast." Because we made it vast. It could have been small. "We're literally veering into cartoon territory here" Yes we are, because spying on millions of people and then leaving that data unprotected is childishly irresponsible. Ordinary citizens are the injured party, not companies. They have given up privacy and control over their devices. Even the software that runs on voting machines is copyrighted and secret, and when inspected, it turned out even the basics of security have not been followed. Now that the chickens are coming home to roost, why are you so vehemently looking to absolve them of all responsebility? It's breathtakingly hypocritical.
wyager 5y ago
> So, if it's the successful attack that prompts those defenses, then it's already too late. Reality is not a single-round game. > Doing it retroactively with mountains of technical debt is even harder. Building mountains of technical debt is precisely the behavior companies need to stop. > The reality is we need to stop thanking the criminals and support/protect our companies/agencies with a "layer" above their own security, including via deterrence at the nation-state level. You can’t accuse someone of being idealistic and then turn around and say this.
SilverRed 5y ago
> I'm puzzled by the constant stream of people thanking the criminals and blaming the victims The problem is the criminals can be anywhere in the world and can not be removed. When criminals are a constant, security is the only variable.
- unclebucknasty 5y ago
  >The problem is the criminals can be anywhere in the world Perhaps, but we tend to trace the lion's share to one of very few places. >When criminals are a constant, security is the only variable. Security also comes through deterring would-be attackers. Security is not simply a posture of attempting to deflect as many attacks as possible. Ever play Missile Command? In fact, that's disastrous policy. And, even if it were possible to get every company/governmental agency to immediately invest in massive security overhauls along with all vendors, OSS, etc. with near instantaneous results, some attacks will invariably get through. Seems pretty obvious that we don't want attackers with 100% upside and no downside.

ClumsyPilot 5y ago

"The reality is we need to ... support/protect our companies/agencies" Like how we protect them from all legal consequences of loosing private information of millions of people time after time, such as recent Equifax and Facebook cases? Or like how we allow companies to sell vulnerable routers, IP cameras, internet enables printers and phones with knows vulnerabilities at the time of release, and leave it without updates? they are getting away with murder and you are asking for more protection for them? Maybe it's time to accept that this industry is greedy, arrogant and negligent in a way that's unmatched by almost anyone, except maybe hedgefunds.

unclebucknasty 5y ago
>Maybe it's time to accept that this industry is greedy, arrogant and negligent in a way that's unmatched by almost anyone, except maybe hedgefunds. "This industry"? Which industry is that? I mean, it's a tempting narrative: a big greedy industry, etc. But, this is not isolated to any one industry or any one company. These are attacks by foreign actors on a variety of our companies, government agencies, infrastructure, etc. And they result in real harm to our economy, infrastructure, and people. >allow companies to sell vulnerable routers, IP cameras, internet enables printers and phones with knows vulnerabilities at the time of release, and leave it without updates Again, this sounds like a compelling narrative, and sure, there need to be improvements. But, the reality is that the attack surface is vast and includes zero-days in well-maintained software, social engineering, OSS, custom software, network configs, etc. In general, it seems like there's a lot of anger in your post, but none of it directed at the actual criminals (or their national sponsors) who are actually responsible for the attacks. That's really puzzling to the point where it almost reads like defending the criminals.
- ClumsyPilot 5y ago
  "These are attacks by foreign actors" We have plenty of our own hackers and ransomware, i am not seeing how foreign-angle adds anything to the debate "none of it directed at the actual criminals" There will always be criminals. If a bank was robbed by two kids armed with a banana, then the real fault lies with the bank's management for being negligent, and every court will recognise it. As it stands, most data leaks and hacks are not unpreventable zerodays, they are people being negligent and irreaponsible. Large organisations need to change, and ignorance of the issue needs to be adressed. This is not just "there need to be some minor improvements"
  - unclebucknasty 5y ago
    >We have plenty of our own hackers and ransomware The overwhelming majority of the recent, most notable attacks have been traced near-exclusively to foreign actors, including the one that is the subject of the actual thread here. >i am not seeing how foreign-angle adds anything to the debate Of course, it has everything to do with the debate. Specifically, with how we respond/deter. >most data leaks and hacks are ... people being negligent and irreaponsible. The attack surface is vast. >If a bank was robbed by two kids armed with a banana We're literally veering into cartoon territory here. Not sure I understand why you're working so hard to exonerate the actual criminals.
    - ClumsyPilot 5y ago
      "most notable attacks have been traced near-exclusively to foreign actors" Most criminals are "foreign" because most of Earth's population is foreign. "The attack surface is vast." Because we made it vast. It could have been small. "We're literally veering into cartoon territory here" Yes we are, because spying on millions of people and then leaving that data unprotected is childishly irresponsible. Ordinary citizens are the injured party, not companies. They have given up privacy and control over their devices. Even the software that runs on voting machines is copyrighted and secret, and when inspected, it turned out even the basics of security have not been followed. Now that the chickens are coming home to roost, why are you so vehemently looking to absolve them of all responsebility? It's breathtakingly hypocritical.

wyager 5y ago

> So, if it's the successful attack that prompts those defenses, then it's already too late. Reality is not a single-round game. > Doing it retroactively with mountains of technical debt is even harder. Building mountains of technical debt is precisely the behavior companies need to stop. > The reality is we need to stop thanking the criminals and support/protect our companies/agencies with a "layer" above their own security, including via deterrence at the nation-state level. You can’t accuse someone of being idealistic and then turn around and say this.

SilverRed 5y ago

> I'm puzzled by the constant stream of people thanking the criminals and blaming the victims The problem is the criminals can be anywhere in the world and can not be removed. When criminals are a constant, security is the only variable.

unclebucknasty 5y ago
>The problem is the criminals can be anywhere in the world Perhaps, but we tend to trace the lion's share to one of very few places. >When criminals are a constant, security is the only variable. Security also comes through deterring would-be attackers. Security is not simply a posture of attempting to deflect as many attacks as possible. Ever play Missile Command? In fact, that's disastrous policy. And, even if it were possible to get every company/governmental agency to immediately invest in massive security overhauls along with all vendors, OSS, etc. with near instantaneous results, some attacks will invariably get through. Seems pretty obvious that we don't want attackers with 100% upside and no downside.