12 ms·
NATO Classified Cloud Platform Compromised
- randombits0 5y agoHow’s that Zero Trust working out for ya?
- HHC-Hunter 5y agoI really wish more companies would implement Zero Trust. It's just so nonsensical to trust any device at this point - No matter how "secure" someone tells you it is, or even you think it is.
- grumblenum 5y agoIs there a clear definition of what ZTA even is? I read the O'Reilly book, and as best I can tell, the advice was fairly obvious recommendations and also 'replace your firewall as a single point of failure and make your access-control system your single point of failure'.
- jimbojet 5y agoBetter than trusting the perimeter. A single breach in a “trustful” intranet still results in full network compromise. Best to assume breach and work from there. Hating on zero trust is non-sensical to me, feels like the same as hating on security.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- yardstick 5y agoGiven that, would zero trust plus perimeter have better security than each approach individually? Layered defense etc.
- knownjorbist 5y agoWhat does zero trust have to do with this?
- dhx 5y agoThe IdM box in the provided diagram [1] is the same single point of failure "policy engine" and "ID management" architecture that is advocated by the "zero trust" crowd [2]. It's the same type of flawed centralised architecture that allowed the Solarwinds Orion exploit to be used to such great effect [3]. At least the ZTA paper calls out this weakness [4], but unless I missed something the paper severely understates the risk that a central "policy engine" presents, and glosses over all the other components ("threat intelligence feeds", host-based agents, etc) which are centralised in this architecture and present a similar risk. [1] https://imgur.com/Hcwayqq https://imgur.com/Hcwayqq [2] NIST SP 800-207, Figure 2, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S... [3] https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach#SolarWinds_exploit_2 https://en.wikipedia.org/wiki/2020_United_States_federal_gov... [4] NIST SP 800-207, Section 5.1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
- xvector 5y agoZero Trust is the future.
- southerntofu 5y agoI wouldn't call running random Docker images from the Internet a "zero trust" environment.
- iagovar 5y agoEveris is the typical meat grinder, and it is known for that in Spain. Now, just as I'm writing this I'm sure someome from Everis will chime in to say he gets paid handsomely and works for amazing projects. But everyone I've known working for Everis wants to die. And if such project had to land in Spain for political reasons, there are plenty of companies capable on taking such project with way better prospects.
- zeusk 5y agoSo it's akin to Capgemini, Infosys, Accenture, Deloitte, PwC, TCS and the like?
- gary_0 5y agoDon't forget Oracle.
- DaiPlusPlus 5y agoOracle still has a product though.
- Foobar8568 5y agoI wouldn't put Deloitte or PwC with the other ones. But yeah, you can add Atos techmindra etc for body shops. Accenture pretends to be like a big4 (like most consultancy) but they are much closer to an Atos/Infosys than PwC.
- zeusk 5y ago> wouldn't put Deloitte or PwC with the other ones. I'm not convinced. I attended one of their recruitment events at university - lots of synergy going around. In fact I forgot about EY and a bunch of others too.
- iagovar 5y agoYep. They take on some "advanced" projects too, but at the end of the day it's a meat grinder.
- 0xCMP 5y ago> "which basically tricks organizations into spending a ton of money for installing Docker into a CentOS image without any cryptographic signature to verify the integrity of that image." Ouch
- irjustin 5y agoIn the end, I think NATO was done a service by this.
- joe_the_user 5y agoOnly if they learn something from the experience
- devetec 5y agoDistributed Denial of Secrets, you've done it again!
- alexfromapex 5y agoHow was it breached and what’s the fall out?
- neatze 5y agoMy only question is; why such project was connected to the internet at all ?
- 88840-8855 5y agoDo you know anyone who does not want to work from home?
- tsjq 5y agoUpper management. Everywhere they want the rank & file to stop WFH and come back to office.
- trutannus 5y agoMore like people who can't. Working with sensitive documents sometimes requires physical engineering considerations (ie: viewing rooms). Not something that can be replicated in an employee's home. Contrary to what software devs like myself like to think, not every job can be done remotely!
- pjc50 5y agoA computing cloud that's not connected to the internet is completely useless. Besides, how else would the lowest bidder international contractor be able to work on it?
- kevin_thibedeau 5y agoDoD has a parallel internet inaccessible from outside secure sites. They can follow the same approach with NATO computing needs.
- viraptor 5y agoNot if your private environment is large enough that you can create individual cloud platforms inside of it. One level more detached than AWS GovCloud / whatever Ali does. The contractors would likely never touch the live system. Just deliver the project to deploy.
- 5y ago
- RcouF1uZ4gsC 5y ago> It will drive innovation and reduce operational costs by ensuring much greater reuse of capabilities. I feel I have seen this vague promise on a lot of software projects that either failed or overran budget significantly.
- Aeolun 5y agoIt's because it practically boils down to: "We want all of the functionalities we are currently using in a variety of different systems in one system, but we're unwilling to make any compromises on the feature list. Everything has to be implemented exactly as it is in it's current system." And then, obviously, the project fails spectacularly. The only projects like this I've seen succeed were ones where the top dog (CEO/president, whatever) basically forced everyone to compromise personally.
- cpach 5y agoDoes anyone know if there are other sources that can confirm the breach?
- xabi 5y ago[Spanish] - https://escudodigital.com/defensa/hackeo-everis-otan-proyecto-polaris-ciberataque/ https://escudodigital.com/defensa/hackeo-everis-otan-proyect... - https://www.everis.com/spain/es/news/newsroom/everis-disena-la-plataforma-de-la-otan-que-sienta-las-bases-para-los-servicios https://www.everis.com/spain/es/news/newsroom/everis-disena-...
- noobermin 5y agoReading the start of this article reminded me of a somewhat unrelated thing I saw: I remember seeing in "tech influencer" youtube video on how "Japan hasn't kept up with the west" when it comes to IT. Not to be super orientalist or whatever and assume Japan is doing better the US in IT, but what should they do instead, go the US route and put every thing on the cloud? Is that better? I couldn't help it, it's literally in the article that this was part of the "NATO modernization" efforts. Perhaps whatever they had before would have failed too but it's clear that these "modernization" efforts aren't always better.
- ithkuil 5y agoStop using fax will be enough to be considered modern by my standards
- georgeplusplus 5y agoA type writer is more secure.
- squeral 5y agoMaybe, until you need to send those docs somewhere.
- ithkuil 5y agonever underestimate the avian carrier EDIT: https://datatracker.ietf.org/doc/html/rfc2549 https://datatracker.ietf.org/doc/html/rfc2549
- T-A 5y agoBeware: https://www.manchestereveningnews.co.uk/news/greater-manchester-news/five-thousand-homing-pigeons-disappear-20925495 https://www.manchestereveningnews.co.uk/news/greater-manches...
- autosharp 5y ago
- Aeolun 5y agoNot that I think internal efforts are always success stories, but outsourcing your identity and access management to the lowest bidder sounds like a recipe for disaster. Who thought this would be a good idea? And why was any of this on internet connected servers anyway?
- Dah00n 5y agoWell, it's not like it's something new. Everything from roads to fighter jets get built like this. This is how we got the F-35s for example.
- jll29 5y agoFavorite quote: "(...) so that the information security community and the general public can judge the quality of your work, which basically tricks organizations into spending a ton of money for installing Docker into a CentOS image without any cryptographic signature to verify the integrity of that image."
- edu 5y agoAn interesting data point is that Everis is owned (2014 acquisition) by NTT Data Group [1], it provides consulting and outsourcing services and it doesn't have the greatest reputation 1. https://www.everis.com/global/en/about-us https://www.everis.com/global/en/about-us