3 ms·

Uhh... Yea. we do (and I wouldn't even bucket my organization as one that is good at engineering/systems). VPN, email, slack, ssh are all behind multifactor. >

by genmud 5y ago

Uhh... Yea. we do (and I wouldn't even bucket my organization as one that is good at engineering/systems). VPN, email, slack, ssh are all behind multifactor. > Bucketing MFA into one broad concept is as disingenuous as calling out security headers as being as benign as CORS. Does your org have MFA on SSH? On email? On the code repo? On the Slack login? On the VPN(s)? Etc. Etc. I have been doing security for 15+ years and your mindset of "omg its so hard, so we can't do anything" is the exact sort of thing that got the Colonial Pipeline into the situation they are in. > I have yet to see a single org that had MFA on everything and blaming a lack of MFA on the VPN misses the point. If they'd had it there, the attackers would have hit elsewhere. Most developers install random software and browser toolbars that they'll never have time to check and connect directly to their companies servers, repos, and communication tools. Pretending like MFA on a VPN would have magically solved everything is a pipedream. There are too many ways in, and every time someone gets in the response from the software community is always "oh why didn't they do X" while ignoring the larger truth: There are too many threat vectors and getting them all right, at all times, is nigh on impossible. Well, we should just give up and do nothing, right? You probably need to see more organizations, I am really not trying to be a dick, but I truly hope you aren't in a position of authority or in charge of security for any sizable organization. I have seen about 30-40 medium-large organizations breached by account takeovers (ATOs) over the last 5 years or so. At this point if you don't have SSO backed by MFA on everything (email, vpn, slack, git/vcs, salesforce, marketing sites, etc.) you are playing with fire. With things like Okta, Duo and Yubikey, there are just no excuses.

3pt14159 5y ago
No. I did not say we should do nothing. What I said was people keep focusing on the one thing that the attackers used to get in, but that one thing is besides the point. I explicitly said that MFA raises the stakes. The point I was trying to make was that whatever the attack was, the thing that gets reported on, is so very rarely an attack that engineers side with the defender. It's almost always something like "oh why didn't they do X" where X could be thousands of things. I know you say you're "not trying to be a dick" and all, but this is what I wrote in my original comment: > the long tail of organizations just don't have the right staff, focus, or resources to do it. If you reread my original comment you'll see what I'm trying to get software developers to understand. Securing these systems is nigh on impossible. Orgs lack incentives to do it to the fullest degree. If it weren't, 0days for iOS or Windows would cost billions. I'm not excusing these large organizations—though actually working with the people involved gives me some perspective as to why they don't always have MFA on their VPNs—I'm trying to get the broader point across that we shouldn't trust such critical infrastructure to vulnerable computers. That there should be regulations and audits with fines. And honestly, the way you worded your final paragraph is kinda confusing. You've seen a couple dozen orgs with account takeovers and your conclusion is that they're all playing with fire? Maybe what I said in my original comment on the article has some merit. Regardless, I've seen enough to know that "the problem" isn't a random VPN lacking MFA.

by genmud 5y ago

3pt14159 5y ago

No. I did not say we should do nothing. What I said was people keep focusing on the one thing that the attackers used to get in, but that one thing is besides the point. I explicitly said that MFA raises the stakes. The point I was trying to make was that whatever the attack was, the thing that gets reported on, is so very rarely an attack that engineers side with the defender. It's almost always something like "oh why didn't they do X" where X could be thousands of things. I know you say you're "not trying to be a dick" and all, but this is what I wrote in my original comment: > the long tail of organizations just don't have the right staff, focus, or resources to do it. If you reread my original comment you'll see what I'm trying to get software developers to understand. Securing these systems is nigh on impossible. Orgs lack incentives to do it to the fullest degree. If it weren't, 0days for iOS or Windows would cost billions. I'm not excusing these large organizations—though actually working with the people involved gives me some perspective as to why they don't always have MFA on their VPNs—I'm trying to get the broader point across that we shouldn't trust such critical infrastructure to vulnerable computers. That there should be regulations and audits with fines. And honestly, the way you worded your final paragraph is kinda confusing. You've seen a couple dozen orgs with account takeovers and your conclusion is that they're all playing with fire? Maybe what I said in my original comment on the article has some merit. Regardless, I've seen enough to know that "the problem" isn't a random VPN lacking MFA.