6 ms·
>These people can tell you so much about the theory of security by heart that it will make you dizzy but then won't actually understand the underlying problems.
by cheese_van 5y ago
>These people can tell you so much about the theory of security by heart that it will make you dizzy but then won't actually understand the underlying problems.
I've thought greatest failure of many professionals in this field is in the "protect the network" perspective rather than "protect the data". While many of them fess up to "we can make it difficult but not impossible" to breach the network, that is not evinced by the protections instituted.
If companies actually understood that they WILL be hacked, the focus would turn to protecting the data. Actual resting data protection would allow a "I don't care if I'm hacked," posture. Either behind encryption, VM's, segregation, or architectures, preferably all, if data is actually protected, then a hack can be weathered. It's still a pain if the computer-touchers have to rebuild and reload, but that's what you pay them for. If the data is protected, a hack is just a painful exercise rather than a newsworthy event.
I do understand that segregating (through protection and architecture) data is difficult, but I do not understand why it is not the focus.
- rjzzleep 5y agoI always thought that when thinking security a compromised system HAS to be rebuilt. I have never seen that happen in an enterprise though. They never ever rebuild compromised systems they just try to improve perimeter protection.
- srtjstjsj 5y agoRebuilding the entire IT deployment is prohibitively expensive. Imagine if the solution to Covid was "the virus can spread to anyone, we need to replace all humans"
- rjzzleep 5y agoWhen a machine/server/laptop/PC is hacked, it's considered compromised. No amount of pruning that system can restore trust in it. It needs to be reset. It's only prohibitively expensive because most of these enterprise tools and servers are actually very much focused on manual setup.
- petra 5y ago>> Actual resting data protection would allow a "I don't care if I'm hacked," posture. That's quite interesting. Where can I read more about that ?
- miohtama 5y agoI think something along these lines is called “zero trust” and especially Google has been aggressively implementing it. But I could not find have any high quality articles on the concept. https://www.csoonline.com/article/3247848/what-is-zero-trust-a-model-for-more-effective-security.html https://www.csoonline.com/article/3247848/what-is-zero-trust...
- srtjstjsj 5y agoZero trust protects the servers, not the network, and not the data. Protecting the data means encrypting it (which Google also does) such that the client needs a key to decode it. But if the client is hacked, the hacker can get their keys! so encrypting the data isn't a magical cure-all.
- rixed 5y agohttps://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
- natmaka 5y agoIn many cases you don't want to let an hostile party read confidential data, and if he takes control of the machine aren't all bets off? Moreover what if a hostile party constantly hammers-disrupts your IT, letting you teams "rebuild and reload" 24 hours/day (in other words you don't have any information system anymore)?
- afrodc_ 5y agoI think the idea is that after you get compromised, you do forensics to address the vulnerability that exposed you, then after addressing the fixes in your perimeter, you reset the compromised systems. The attacker wouldn't be able to hammer you again without having another vulnerability in that case
- srtjstjsj 5y agoIf hacker hack your systems, they get the decryption keys too. They just might need to hit two separate targets with two attacks or a attack that both are vulnerable to.