7 ms·

I'm a bit tired of the victim blaming with security. The victims of these breaches are the end users. Companies are the beneficiaries of not having to pay for

I'm a bit tired of the victim blaming with security. The victims of these breaches are the end users. Companies are the beneficiaries of not having to pay for and especially not having to inconvenience themselves with much more secure systems. That said, it's true you can't ask for 100% security. You can instead set standards. You can especially set standards of security for any enterprise that the public dependents on. Since, there are no coherent standards now, just liability isn't useful. And the standards should involve actual topology, what kinds of information is allowed in and out at all.

xupybd 5y ago
You have to enforce standards. Good security is expensive. If companies in competition don't have to pay for good security those that do have it will have higher costs and have trouble competing.
- fsckboy 5y ago
  > "running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing" running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing
  - deleted 5y ago
    [deleted]
  - toomuchtodo 5y ago
    Texas? Winterization that wasn’t done and wasn’t required, and thereby those generators who didn’t had a more competitive edge? The similarities write themselves.
    - xupybd 5y ago
      Thanks, that explains it.
- joe_the_user 5y ago
  Why I said you have to actually force the standards down people's throat, with laws or liability. Restaurants don't like health standards either.
  - xupybd 5y ago
    Yep, wasn't disagreeing just wanted to highlight the importance of enforcement / regulations. This much like work place safety. You have to force it or the unsafe businesses get too much of an advantage.
deleted 5y ago
[deleted]
creato 5y ago
Many of the most serious recent incidents don't involve theft of end user data or impacting end users in any real way, unless you consider the "end users" of gas stations and ferry boats to be the victims of these attacks. That's not incorrect in a way, but also seems like a pointlessly wide net. The thing I'm a bit tired of is IT people in these threads taking every incident that comes along as an opportunity to elevate their pet cause. These more serious incidents have more in common with mafia extortion rackets than computer security.
- joe_the_user 5y ago
  The debate is pretty much divided between people who say "improved security is the solution" and people who say "treating it as crime/terrorism/the-mafia is the solution". I'm in the improve the security camp. I think security can be improved if we impose good standards (meaning enforce inconvenient things like no backdoor updating apps, no critical infrastructure connected to the web). The reason "treating this like terrorism" is useless is that there's always another hacker. It's hard but not that hard and anything doable today will be automatable tomorrow.
  - runeks 5y ago
    Your viewpoint is extreme. Saying the increased effort by law enforcement is “useless” is unfounded. Sure, it won’t solve the problem by itself, but it’s entirely possible it will help.
    - ClumsyPilot 5y ago
      What is the percentage of hacks that are ultimately traced to individual and result in his imprisonment? 0.1%? Are you going to ever get that even over 10%? If the hack comes from a jurisdiction without extradition, how will you solve that? How foea a country know they are not allowing their citizens to be harrassed with trumped up charges? What if definition of hacking differs in two countries? It is not just Russia and China, Denmans and Uk have refused to extradite to the US becausw pf concerns over inhumane treatment. https://www.theguardian.com/world/2019/may/10/dutch-court-blocks-extradition-of-man-to-inhumane-uk-prisons https://www.theguardian.com/world/2019/may/10/dutch-court-bl...
azinman2 5y ago
There are many standards out there such as SOC-2. But that’s not particularly meaningful against dedicated professional hackers. It’s a totally asymmetric game.
- peteretep 5y ago
  It's in fact the inverse of: "The bad guys need to get lucky every time. The good guys just need to get lucky once."
- BrandoElFollito 5y ago
  These standards are more or less useless. It seems that people who swear by them expect the hackers to attack some documents or a powerpoint presentation. These standards (and PCI-DSS, and ISO, and NIST (and this one is by far the best)) have plenty of blah blah that never gets implemented. They rely on some magical risk assessment exercices with a nice risk grid that gives you answers. The reality is that the top 5-10-whatever risks are very simple to assess and very difficult to address. Unfortunately such concerns do not exist for the writes of standards. I have been doing information security for 25 years in huge companies. The more relevant the risk is, the more painful it is to implement. Even the ones such as "awareness" that theoretically should be useful assume that people care or think. I get emails from people who went though 10 awareness sessions who wonder why someone wants to enlarge their penis. And yes, the awareness sessions wera like in the ads: short, to the point, entertaining, relevant, magical. So now imagine rising a risk that endangers the key legacy system that cannot be isolated.

xupybd 5y ago

You have to enforce standards. Good security is expensive. If companies in competition don't have to pay for good security those that do have it will have higher costs and have trouble competing.

fsckboy 5y ago
> "running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing" running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing
- deleted 5y ago
  [deleted]
- toomuchtodo 5y ago
  Texas? Winterization that wasn’t done and wasn’t required, and thereby those generators who didn’t had a more competitive edge? The similarities write themselves.
  - xupybd 5y ago
    Thanks, that explains it.
joe_the_user 5y ago
Why I said you have to actually force the standards down people's throat, with laws or liability. Restaurants don't like health standards either.
- xupybd 5y ago
  Yep, wasn't disagreeing just wanted to highlight the importance of enforcement / regulations. This much like work place safety. You have to force it or the unsafe businesses get too much of an advantage.

deleted 5y ago

[deleted]

creato 5y ago

Many of the most serious recent incidents don't involve theft of end user data or impacting end users in any real way, unless you consider the "end users" of gas stations and ferry boats to be the victims of these attacks. That's not incorrect in a way, but also seems like a pointlessly wide net. The thing I'm a bit tired of is IT people in these threads taking every incident that comes along as an opportunity to elevate their pet cause. These more serious incidents have more in common with mafia extortion rackets than computer security.

joe_the_user 5y ago
The debate is pretty much divided between people who say "improved security is the solution" and people who say "treating it as crime/terrorism/the-mafia is the solution". I'm in the improve the security camp. I think security can be improved if we impose good standards (meaning enforce inconvenient things like no backdoor updating apps, no critical infrastructure connected to the web). The reason "treating this like terrorism" is useless is that there's always another hacker. It's hard but not that hard and anything doable today will be automatable tomorrow.
- runeks 5y ago
  Your viewpoint is extreme. Saying the increased effort by law enforcement is “useless” is unfounded. Sure, it won’t solve the problem by itself, but it’s entirely possible it will help.
  - ClumsyPilot 5y ago
    What is the percentage of hacks that are ultimately traced to individual and result in his imprisonment? 0.1%? Are you going to ever get that even over 10%? If the hack comes from a jurisdiction without extradition, how will you solve that? How foea a country know they are not allowing their citizens to be harrassed with trumped up charges? What if definition of hacking differs in two countries? It is not just Russia and China, Denmans and Uk have refused to extradite to the US becausw pf concerns over inhumane treatment. https://www.theguardian.com/world/2019/may/10/dutch-court-blocks-extradition-of-man-to-inhumane-uk-prisons https://www.theguardian.com/world/2019/may/10/dutch-court-bl...

azinman2 5y ago

There are many standards out there such as SOC-2. But that’s not particularly meaningful against dedicated professional hackers. It’s a totally asymmetric game.

peteretep 5y ago
It's in fact the inverse of: "The bad guys need to get lucky every time. The good guys just need to get lucky once."
BrandoElFollito 5y ago
These standards are more or less useless. It seems that people who swear by them expect the hackers to attack some documents or a powerpoint presentation. These standards (and PCI-DSS, and ISO, and NIST (and this one is by far the best)) have plenty of blah blah that never gets implemented. They rely on some magical risk assessment exercices with a nice risk grid that gives you answers. The reality is that the top 5-10-whatever risks are very simple to assess and very difficult to address. Unfortunately such concerns do not exist for the writes of standards. I have been doing information security for 25 years in huge companies. The more relevant the risk is, the more painful it is to implement. Even the ones such as "awareness" that theoretically should be useful assume that people care or think. I get emails from people who went though 10 awareness sessions who wonder why someone wants to enlarge their penis. And yes, the awareness sessions wera like in the ads: short, to the point, entertaining, relevant, magical. So now imagine rising a risk that endangers the key legacy system that cannot be isolated.