7 ms·

Isn't one of the main problems with ransomware centralised and locked down IT administration? I mean if the computers were not tied together so tightly the effe

• runeks 5y ago
  What’s the alternative given that most small/medium-sized companies know very little about IT security? Seems to me like a centralized system is fine, as long as it’s properly designed and implemented. The problem is how a business can know that an IT security system is properly designed and implemented. The only solution I see is to couple insurance with an IT security system. If you’re certain your system protects against IT threats you should be willing to compensate your customer in case it fails to do so. Otherwise your customer has a very hard time determining whether your IT security system actually works.
  • throwawaygh 5y ago
    > What’s the alternative given that most small/medium-sized companies know very little about IT security? Removing the "remote" from "remote administration". It's more expensive but probably still not cost-prohibitive -- driving around to client sites and installing updates is not particularly skilled labor. Plus even the worst-case scenarios are far less worse because you already have a local workforce who can do site visits to manually recover systems locked down by ransomware attacks. Data might get stolen, but at least you have continuity of business.
    • markzzerella 5y ago
      They could even have a 'reverse shell' type button that the client has to explicitly click to enable temporary remote access.
    • twistedpair 5y ago
      What if you could somehow rate limit it? e.g. you can access N remote offices per day, but not all of them. Like the time lock on a safe, to prevent these pervasive smash and grabs.
• ashtonkem 5y ago
  Removing centralized IT management comes with other issues, especially rampant email viruses in the org due to poor compliance with update and security policies.
  • ok123456 5y ago
    If this were 2003, yes. Try to get Windows 10 to have an uptime of more than two weeks without an Windows Update and reboot cycle. Email viruses aren't really a thing like they were back then too.
    • tomc1985 5y ago
      Only because the protections are there for email viruses. Phishing and spearphishing are still popular attack vectors, so we know people would be susceptible to something like iloveyou if it were to get past other defenses
      • ok123456 5y ago
        Those protections are done up-stream at the MTA level and completely passive for the end user. The "security best practices" are a cargo cult exercise that just lulls organizations into believing they're protected against motivated actors, when instead they're just enforcing a group policy on a good day.
• ok123456 5y ago
  Yes. It's much of the security theater that has led to the state of things. Third-party administration and monitoring agents like Solarwinds are an incredible attack vector. A lot of the "security best practices" just become checklists of what people thought were good ideas 20 years ago and enforced by auditors that only know how to check boxes.
  • throwawaygh 5y ago
    > security theater aka sales & marketing. I wonder if the background of senior leadership is predictive in these sorts of situations. E.g., Equifax had a CISO with a non-technical background at the time of their breach, and Kaseya's leadership is dominated by MBAs and accountants.
    • ok123456 5y ago
      Then it just becomes another thing that's gamed. Useless certs are used to cover for a lackluster technical background.
  • edrxty 5y ago
    Quarterly password resets, five different "single sign on" services, no admin for devs. Sometimes I feel like the idea is just to kill productivity.
    • ok123456 5y ago
      When I have to work in a "no admin for devs" environment, I just take admin access one way or another. They kill productivity in exchange for job security.
      • goldenkey 5y ago
        There's no shortage of privilege escalation bugs in Windows, Mac and Linux. Hell, if you spend a week with a decent dissasembler, even an amateur can probably find a 0-day.
      • 5y ago
• javajosh 5y ago
  Yes, but centralization is a symptom of something deeper: incumbent business interests with top-down power structures actively disincentivize the holistic, creative, critical thinking required to mount a meaningful distributed cyber-defense, and incentivize CYA approaches which leads to weaker centralized solutions. "Well, we spent $10M on defense - put some appliances in a NOC, paid contractors, gave our CTO a bonus - what more could we do?" Ultimately the legal system will accept this as a valid excuse. Whereas, if you take more holistic steps, embrace distributed responsibility and action, incentivize awareness of threats and threat-modeling, and get sued as liable, a judge could very well say, "But you didn't spend a significant chunk of your revenue to build [out the same kind of solutions I'm used to seeing in cases like this]? Negligence!" When ignorance becomes so widespread that it is enforced by law, and wise action is actively punished, and one cannot really blame rational actors for taking the CYA approach. One can hope that some of them take a principled stand and the risk of punishment to do more; alternatively, we can expect to collapse and be replaced by a smarter, if more brutal regime. One way or another, the bleeding always stops.
  • kaibee 5y ago
    > "But you didn't spend a significant chunk of your revenue to build [out the same kind of solutions I'm used to seeing in cases like this]? Negligence!" Is there any evidence that this happens? I feel like there's a lot of these kind of spooky 21st century "folk-wisdom"(s) out there and if you actually trace it back its like the McDonald's hot coffee case or whatever.
    • javajosh 5y ago
      It's a good question. I'm basing this mostly on my impression of recent PR releases, post-intrusion, that make the argument "We spent money on it! It's not our fault it didn't work!" I've noticed that PR releases tend to echo the eventual legal argument. There's at least some evidence it's not a McDonalds hot coffee lawsuit thing (although I really hope I'm wrong).
  • deleted 5y ago
    [deleted]
• dheera 5y ago
  Also, why is it so hard for them to track down ransomware perpetrators? Doesn't the NSA have back doors and gag orders to everything? Are the ransomware people really not using any Google/Microsoft products that can be used to track them down and banish them? Can we not hard fork Bitcoin to make ransomware wallets inactive?
  • SV_BubbleTime 5y ago
    The problem with hacking, and call criminal activity really, used to be “getting your money out”. Yea. You have money somewhere, but when you go to get it they’ll find you. Crypto laundering has made that trivial now. So, no, I don’t believe the NSA has back doors in “everything”. (Nor would I consider the NSA to be unequivocal “good guys” who selflessly help businesses and employees)
    • brandon272 5y ago
      It's an interesting point: governments have invested untold billions [1,2.3] into internet surveillance of the entire population but these crypto teams elude them. [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center [2] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A [3] https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program)
      • markzzerella 5y ago
        Because the surveillance is nothing but a tool for control and compliance. Solving crimes was never the point. It would not surprise me in the least if we found out in 50 years that these crypto groups were just another government team hoovering up data and getting more off the books funding.
  • secfirstmd 5y ago
    The NSA has actually lost some of its tools (Shadowbrokers) and backdoors (Juniper Networks)
  • 5y ago
• ocdtrekkie 5y ago
  Yes and no. Not having centralized IT administration is worse: People able to install their own root-level malware is a dramatic and exciting turn that I think everyone is glad to be away from. But IT people are also the worst IT customers: They often think they're too smart to fall for the tricks other employees face, and when they do fall for them, the damage is far worse. We have narrowed the attack surface of networks drastically, the solution is not to undo that, but to keep narrowing it. There's a lot of room for improvement especially in service accounts, admin accounts, and crucially, more intelligent behavior detection. Despite Microsoft's best cloud security capabilities, it still doesn't seem to mind if a senior citizen's Outlook.com account is suddenly logged into in Nigeria, and even after "securing the account", it doesn't clear their devices they connected while they were in the account... That's a consumer example, but there's so much room for more intelligent behavior detection, and it to make it down to base-level products, and not expensive add-ons or upgrades. Even the big companies don't do a good job at it on their own systems, much less the systems they sell to other people. You have to have a certain tier of premium Azure cloud-based subscriptions to get reasonably decent security controls, while if you have a Windows Server-based network, your security options are the same as you had back in 2008.
  • vel0city 5y ago
    > Despite Microsoft's best cloud security capabilities, it still doesn't seem to mind if a senior citizen's Outlook.com account is suddenly logged into in Nigeria Geo-IP services are routinely inaccurate. I'm in the Southern US, the IP I used to get used to get me tagged as if I was from Quebec City. It was like that for over two years. A friend's house a few neighborhoods over showed up as some small town in Kansas. I could go from my home network-wise in allegedly Quebec City to my cell phone which showed as a town about 50 miles away from my actual location to Kansas in 10 minutes. If places banned based on these kinds of Geo-IP databases I'd be banned from most of the internet.
    • ocdtrekkie 5y ago
      Even then, that's on the same continent. If Microsoft can't tell traffic is traveling across an ocean, what on earth are we doing as an industry? And there's a difference between "ban everyone reporting outside their city" and "flag unusual behavior and trigger additional protections or checks". Think how your credit card works when you suddenly make a purchase in Las Vegas. And in my cited example, the logins were reported as malicious to Microsoft, their account panel said the account had been "secured" since then... but Microsoft apparently let an Android phone the attackers linked up in Nigeria remain connected to the account, giving them persistence past password resets.
• INTPenis 5y ago
  I could be wrong but the CEO kept mentioning their "Cyberdefense playbook" and how it dictates immediate shutdown of services at sign of breach. Well didn't their Cyberdefense playbook have anything to say about simple ACLs protecting those internet facing systems that were vulnerable to SQL injections? I mean even a very broad ACL allowing an entire country geoip block would be better than nothing.
• joe_the_user 5y ago
  Isn't one of the main problems with ransomware centralised and locked down IT administration? It seems like centralized, locked-down IT combined with security that's mere security theater while allowing third-parties to willi-nilli update their stuff.