5 ms·

Forgive me if these are dumb questions because I'm a programmer not a network engineer, but why are companies exposing critical information and systems to the g

Forgive me if these are dumb questions because I'm a programmer not a network engineer, but why are companies exposing critical information and systems to the global internet? Surely there must be a market for a physically separate and secure private network. Why in 2021 hasn't the email attachment problem been solved. Surely we can sandbox email attachments as the default and only move them out of the sandbox when the consequences of opening them are known. Why are we allowing large sums in the millions to be transferred around the world without giving law enforcement the ability to intercede?

lps41 5y ago
So people can work from home, is probably the most common reason. And many companies probably don’t consider themselves a likely target until after it happens.
- prawn 5y ago
  I don't think the former would be even in the upper-tier of reasons. This company would be a great example of one not considering themselves a likely target though!
capableweb 5y ago
> Why are we allowing large sums in the millions to be transferred around the world without giving law enforcement the ability to intercede? I agree with the rest of your comment but this strikes me as a strange question. Programmers if anyone should realize that you can't always 100% selectively give "good guys" access to something easily without also opening up potential weaknesses for "bad guys". Especially when it comes to large transfers or other essential information, it has to be secure and private for the participants and the participants only.
- okareaman 5y ago
  My last question came in response to recent criticism of crypto currency here: https://twitter.com/Pinboard/status/1399058952336277505 https://twitter.com/Pinboard/status/1399058952336277505 and similar. As someone pointed out, ransomware payments in the millions can't happen without crypto. Banks would stop the electronic payments and cash would require suitcases.
  - blackearl 5y ago
    Wire fraud is pretty common - https://certifid.com/wire-fraud-cost-french-film-group-pathe-22-million/ https://certifid.com/wire-fraud-cost-french-film-group-pathe...
    - hn_throwaway_99 5y ago
      That's really something totally different. That fraud is basically tricking people into sending money where it doesn't belong. Ransomware wouldn't be possible with wires.
  - capableweb 5y ago
    Alright, but still. The ability for some party to block or stop a transfer would make cryptocurrencies not be cryptocurrencies anymore, the topmost reason cryptocurrencies exists in the first place and the reason they are built the way they are built is precisely to have the feature of "unstoppable transfers". Changing that and you might as well use banks as we already have "electronic cash". Using that as a argument against cryptocurrencies is a bit like using "but the water irrigation system is using water" as a argument against irrigation systems, it's the main point of using it in the first place. We can't add selective control to allow just government agencies to stop cryptocurrency transfers, it'll eventually be used by others, one way or another. The only way of stopping anyone from being able to straight up manipulate the chain is to disallow anyone to manipulate the chain.
- dmingod666 5y ago
  Look up swift. Transfer of money is controlled. That is what is (ab)used to impose sanctions.
dogman144 5y ago
I’m a security engineer. To get over the hump, there’s a large amount of cost center and infra spending, and then basically exclusive focus on tech debt-like activities for a few quarters to get everything in place. If the cost was manageable, imagine being on the receiving end of the attitudes you, or hopefully not you but some of your coworkers put towards helping implement these changes as the infra fixes cross so many departments. That’s snark aside, just a candid take. If it was fixable like that, the other issue is IOT doesn’t really have a standard platform to build on that’s secure. The equip leaves a factory in Shenzhen and like who is patch managing that? The producer in China? That activity goes on behind the scenes at company by a security team. Good news is MSFT and AWS are starting to deploy COTS IoT operating systems to help fix. So: crazy tech debt to fix, hard patch/support problems, and then (unmentioned) is ICS pay for security engineers is a About half of market, so talent problems abound.
hayst4ck 5y ago
Let's pretend you want to attack a company. First you scope out attack surface. If you can physically penetrate security there are all manner of attacks you can accomplish and connectivity you are able to achieve. You might go to a search engine like shodan (https://www.shodan.io/ https://www.shodan.io/) and discover some internet exposure that is attackable. You might find e-mails and start phishing/landing trojans. You might be able to execute a supply chain attack (ala solarwinds). You might be able to compromise an employee. After you compromise the corp network you might figure out how to escalate into the infra network. Now you are a company. You have limited resources. Security is not your business. Security is only a "cost." Tech isn't your main business so you need to hire a security minded person without a strong ability to vet them. That security person needs to scope the attack-able surface, model the above risks and more, and implement preventive measures. That person will probably be hired well after infrastructure is already established. That person will have to justify the potentially large resource expenditures involved in solving problems and hiring more security engineers. That person will be a very limited resource and therefore very expensive since our universities don't pump out a lot of security experts. This person will probably have a market rate of well over 300k a year. That person's competence will likely directly correlate to time spent in industry, so new grads probably wouldn't cut it. Maybe you decide to see if companies will sell you solutions to this problem. How do you separate those selling security theater from those who will legitimately solve your security problem? So, if you are the business owner at what point do you decide, "wow, we need to spend a lot of resources (time, attention, and money) on security." After some number of employees? After some dollar cost in business? After some position in industry? When a competitor is breached? Unfortunately the de facto answer appears to be after the first major [embarrassing] incident. Imagine you appear to have had impeccable security and are spending 10 million a year for it. How do you know you are making good on your investment? How do you know 5 mil isn't good enough? How do you know you haven't already been deeply breached by a very competent APT? Unfortunately, the reason we haven't solved the tech problem is that it is an arms race. This stops the problem from fundamentally being a tech problem, but instead a problem of incentives. Taxing poor security via government run pen tests with fines (forced bug bounty), that grow as the number of vulnerabilities are found is a system that might change incentives. Indemnification for (maybe only accredited) white hats might change incentives. Regulating all companies to be part of a bug bounty program might change incentives. Legally requiring breach insurance might change incentives. Alternatively there are probably small fortunes to be made to the first entity able to solve corp net as an economies of scale problem (AWS for corpnet). To answer your question directly. We currently have a system where the average business owner is either uninformed, ignorant, or has calculated cost to be greater than risk, resulting in lower resource expenditure than required to solve these technical problems resulting in poor security that directly puts national security at risk.
peter303 5y ago
They use MicroSoft OSes. That means they buy huge vunerabilities.
doctorshady 5y ago
That's actually a bit more common than people know; a lot of infrastructure has access via modem over the phone network. While that's realistically not been a valid application for web browsing for a long time now, it's certainly a valid way to get a command line interface to equipment without exposing it an unending stream of free security audits. That isn't, of course, to say that there shouldn't be precautions regardless. But it's not the internet, and it lets you transmit information at a distance.

lps41 5y ago

So people can work from home, is probably the most common reason. And many companies probably don’t consider themselves a likely target until after it happens.

prawn 5y ago
I don't think the former would be even in the upper-tier of reasons. This company would be a great example of one not considering themselves a likely target though!

capableweb 5y ago

> Why are we allowing large sums in the millions to be transferred around the world without giving law enforcement the ability to intercede? I agree with the rest of your comment but this strikes me as a strange question. Programmers if anyone should realize that you can't always 100% selectively give "good guys" access to something easily without also opening up potential weaknesses for "bad guys". Especially when it comes to large transfers or other essential information, it has to be secure and private for the participants and the participants only.

okareaman 5y ago
My last question came in response to recent criticism of crypto currency here: https://twitter.com/Pinboard/status/1399058952336277505 https://twitter.com/Pinboard/status/1399058952336277505 and similar. As someone pointed out, ransomware payments in the millions can't happen without crypto. Banks would stop the electronic payments and cash would require suitcases.
- blackearl 5y ago
  Wire fraud is pretty common - https://certifid.com/wire-fraud-cost-french-film-group-pathe-22-million/ https://certifid.com/wire-fraud-cost-french-film-group-pathe...
  - hn_throwaway_99 5y ago
    That's really something totally different. That fraud is basically tricking people into sending money where it doesn't belong. Ransomware wouldn't be possible with wires.
- capableweb 5y ago
  Alright, but still. The ability for some party to block or stop a transfer would make cryptocurrencies not be cryptocurrencies anymore, the topmost reason cryptocurrencies exists in the first place and the reason they are built the way they are built is precisely to have the feature of "unstoppable transfers". Changing that and you might as well use banks as we already have "electronic cash". Using that as a argument against cryptocurrencies is a bit like using "but the water irrigation system is using water" as a argument against irrigation systems, it's the main point of using it in the first place. We can't add selective control to allow just government agencies to stop cryptocurrency transfers, it'll eventually be used by others, one way or another. The only way of stopping anyone from being able to straight up manipulate the chain is to disallow anyone to manipulate the chain.
dmingod666 5y ago
Look up swift. Transfer of money is controlled. That is what is (ab)used to impose sanctions.

dogman144 5y ago

I’m a security engineer. To get over the hump, there’s a large amount of cost center and infra spending, and then basically exclusive focus on tech debt-like activities for a few quarters to get everything in place. If the cost was manageable, imagine being on the receiving end of the attitudes you, or hopefully not you but some of your coworkers put towards helping implement these changes as the infra fixes cross so many departments. That’s snark aside, just a candid take. If it was fixable like that, the other issue is IOT doesn’t really have a standard platform to build on that’s secure. The equip leaves a factory in Shenzhen and like who is patch managing that? The producer in China? That activity goes on behind the scenes at company by a security team. Good news is MSFT and AWS are starting to deploy COTS IoT operating systems to help fix. So: crazy tech debt to fix, hard patch/support problems, and then (unmentioned) is ICS pay for security engineers is a About half of market, so talent problems abound.

hayst4ck 5y ago

Let's pretend you want to attack a company. First you scope out attack surface. If you can physically penetrate security there are all manner of attacks you can accomplish and connectivity you are able to achieve. You might go to a search engine like shodan (https://www.shodan.io/ https://www.shodan.io/) and discover some internet exposure that is attackable. You might find e-mails and start phishing/landing trojans. You might be able to execute a supply chain attack (ala solarwinds). You might be able to compromise an employee. After you compromise the corp network you might figure out how to escalate into the infra network. Now you are a company. You have limited resources. Security is not your business. Security is only a "cost." Tech isn't your main business so you need to hire a security minded person without a strong ability to vet them. That security person needs to scope the attack-able surface, model the above risks and more, and implement preventive measures. That person will probably be hired well after infrastructure is already established. That person will have to justify the potentially large resource expenditures involved in solving problems and hiring more security engineers. That person will be a very limited resource and therefore very expensive since our universities don't pump out a lot of security experts. This person will probably have a market rate of well over 300k a year. That person's competence will likely directly correlate to time spent in industry, so new grads probably wouldn't cut it. Maybe you decide to see if companies will sell you solutions to this problem. How do you separate those selling security theater from those who will legitimately solve your security problem? So, if you are the business owner at what point do you decide, "wow, we need to spend a lot of resources (time, attention, and money) on security." After some number of employees? After some dollar cost in business? After some position in industry? When a competitor is breached? Unfortunately the de facto answer appears to be after the first major [embarrassing] incident. Imagine you appear to have had impeccable security and are spending 10 million a year for it. How do you know you are making good on your investment? How do you know 5 mil isn't good enough? How do you know you haven't already been deeply breached by a very competent APT? Unfortunately, the reason we haven't solved the tech problem is that it is an arms race. This stops the problem from fundamentally being a tech problem, but instead a problem of incentives. Taxing poor security via government run pen tests with fines (forced bug bounty), that grow as the number of vulnerabilities are found is a system that might change incentives. Indemnification for (maybe only accredited) white hats might change incentives. Regulating all companies to be part of a bug bounty program might change incentives. Legally requiring breach insurance might change incentives. Alternatively there are probably small fortunes to be made to the first entity able to solve corp net as an economies of scale problem (AWS for corpnet). To answer your question directly. We currently have a system where the average business owner is either uninformed, ignorant, or has calculated cost to be greater than risk, resulting in lower resource expenditure than required to solve these technical problems resulting in poor security that directly puts national security at risk.

peter303 5y ago

They use MicroSoft OSes. That means they buy huge vunerabilities.

doctorshady 5y ago

That's actually a bit more common than people know; a lot of infrastructure has access via modem over the phone network. While that's realistically not been a valid application for web browsing for a long time now, it's certainly a valid way to get a command line interface to equipment without exposing it an unending stream of free security audits. That isn't, of course, to say that there shouldn't be precautions regardless. But it's not the internet, and it lets you transmit information at a distance.