5 ms·

It's unreasonable to always design around not trusting any third party.

• southerntofu 5y ago
  Sure you must always put some levels of trust in 3rd parties. What level of trust is the important question. Ideally, you distribute that trust among several actors so a single compromise is not too much of a deal. That's why you use different hardware vendors for your routers and servers, another vendor for your network connectivity, and yet other vendors for your software. This way, MiTM is mitigated by TLS (or equivalent) and server compromise is mitigated by a good firewall and network inspection stack. Placing all your eggs in a single Google basket is giving a lot of power to a single "don't be evil" corporation, who may get hacked or compelled by law enforcement to spy on you and your clients.
  • ClumsyPilot 5y ago
    Do it right, and you might mitigate threats, but do it wrong, and you are introducing more points where you could be compromised - a single supplier can be audited, a 100 cannot
• SEJeff 5y ago
  It really depends on your threat model. It is not always unreasonable. Target trusted their HVAC management firm so much that they had full unsegmented access to the LAN in each store. The credit card swipe terminals in the same LAN were totally compromised and millions of users had their credit card credentials stolen. Defense contractors and places that store / manage large amounts of money are totally within their mandates to trust no one, not even many of their own employees.
  • alksjdalkj 5y ago
    Did Target really trust their HVAC firm or was their network just poorly segmented?
    • SEJeff 5y ago
      Both. Someone hacked their HVAC firm to hack target credit swipe terminals. At the time it was the biggest hack in US history.
      • alksjdalkj 5y ago
        Right, I'm familiar with the hack. My point is Target almost certainly didn't decide that the HVAC firm could be trusted to have access to the credit terminals - the fact that they had access was the result of poor security design, not Target's threat model.
        • SEJeff 5y ago
          Ok fair. I see the lack of simple things like segmented vlans as a lack of a threat model entirely. They trusted them implicitly, not explicitly, through their clear incompetence. Perhaps that’s better? I think we are mostly in agreement.
        • EricE 5y ago
          I've often found poor security designs justified by many of the arguments in this thread that it's unreasonable to treat everything as a threat. They know it's a bad design but doesn't matter because the threat is too improbable. Until it isn't :p
          • SEJeff 5y ago
            I’ve been in meetings where executives have said precisely this and I have tried to gently nudge them towards defense in depth.
          • dmos62 5y ago
            It's the everything always part of the argument that's unreasonable. You realise that that's impossible? You can't vet and control the whole stack. And, if you could, it would be prohibitively expensive.