4 ms·

Yes. It's much of the security theater that has led to the state of things. Third-party administration and monitoring agents like Solarwinds are an incredible a

Yes. It's much of the security theater that has led to the state of things. Third-party administration and monitoring agents like Solarwinds are an incredible attack vector. A lot of the "security best practices" just become checklists of what people thought were good ideas 20 years ago and enforced by auditors that only know how to check boxes.

throwawaygh 5y ago
> security theater aka sales & marketing. I wonder if the background of senior leadership is predictive in these sorts of situations. E.g., Equifax had a CISO with a non-technical background at the time of their breach, and Kaseya's leadership is dominated by MBAs and accountants.
- ok123456 5y ago
  Then it just becomes another thing that's gamed. Useless certs are used to cover for a lackluster technical background.
edrxty 5y ago
Quarterly password resets, five different "single sign on" services, no admin for devs. Sometimes I feel like the idea is just to kill productivity.
- ok123456 5y ago
  When I have to work in a "no admin for devs" environment, I just take admin access one way or another. They kill productivity in exchange for job security.
  - goldenkey 5y ago
    There's no shortage of privilege escalation bugs in Windows, Mac and Linux. Hell, if you spend a week with a decent dissasembler, even an amateur can probably find a 0-day.
  - SV_BubbleTime 5y ago
    I’m CTO and have an admin account for whatever i need but… I STILL have an off domain laptop for emergency or diagnostic or debug use.
  - AnIdiotOnTheNet 5y ago
    The lesson here is this: if you make it too inconvenient for people to do their jobs, regardless of why, people will work around you to get things done. Effective security policy must take this into account.
    - korethr 5y ago
      I can't upvote this enough. I have worked IT long enough to see some impressive creativity by users to defeat security policies getting in the way of doing their jobs. I have argued that the raison d'etre of security policy is to ensure the existence and continuity of an environment in which work can get done. I've been told about the importance of the C.I.A triad and other things as though they were refutations of my point, often in tones of voice implying an attitude that this not-security|compliance-tech-is-incapable-of-knowing-what-he's-talking-about-and-therefore-can-be-ignored. I counter-argue that C.I.A et. al. are not refutations of my thesis, but in fact support it. If you can't ensure the confidentiality, integrity, and availability of information or systems for yourself or your customers, you do not, and/or will not, have an environment in which work can get done. So, for the love of getting shit done, stop masturbating with broad and blind application of checklists, and take the time to sit down, really look at what you're trying to do and why, and develop actually useful risk models. And then develop security policies against those risk models. Yes checklists and various standards are useful tools that can help you cover a lot of common stuff, but are not the whole picture.
      - SAI_Peregrinus 5y ago
        A bad security policy is an attack on the Availability part of C.I.A. Your security policy definitely shouldn't lead to leaking information or falsifying data, why is it so acceptable to make system availability go to shit?
- nine_k 5y ago
  According to NIST, quarterly password resets are useless. If your SSO isn't, use a good password manager. Admin access for devs should be audited, and devs should understand that now they need some opsec. Like, separate work and personal machines; if not physically, at least use a different account, better yet, a VM. To say nothing about adding suspicious email / IM attachments. Remember, devs: you are a potential attack vector, a very efficient one.
cartoonworld 5y ago
Damn straight, it's even worse than that though. Blue teams are behind from the start due to the nature of the security landscape. They are further hindered by misguided application of the "move fast and break things" method. You aren't supposed to break your C.I.A. and expose customers and everybody else to huge liabilities. Security needs to be baked into the infrastructure and IT management practices from the start. This requires enforcement, jail, and civil suits. Office of Personnel Management, Ashley Madison, Target and countless other retaikers, Dams and Pipelines and Water, Maersk, Linkedin, all these supply chain hacks and schools and hospitals across the country and the world. This has been going on for decades now, with no accountability at all. It just doesn't seem to be a priority. What in the hell are we doing? Why do MMORPGs have better security than the hospital??

throwawaygh 5y ago

> security theater aka sales & marketing. I wonder if the background of senior leadership is predictive in these sorts of situations. E.g., Equifax had a CISO with a non-technical background at the time of their breach, and Kaseya's leadership is dominated by MBAs and accountants.

ok123456 5y ago
Then it just becomes another thing that's gamed. Useless certs are used to cover for a lackluster technical background.

edrxty 5y ago

Quarterly password resets, five different "single sign on" services, no admin for devs. Sometimes I feel like the idea is just to kill productivity.

ok123456 5y ago
When I have to work in a "no admin for devs" environment, I just take admin access one way or another. They kill productivity in exchange for job security.
- goldenkey 5y ago
  There's no shortage of privilege escalation bugs in Windows, Mac and Linux. Hell, if you spend a week with a decent dissasembler, even an amateur can probably find a 0-day.
- SV_BubbleTime 5y ago
  I’m CTO and have an admin account for whatever i need but… I STILL have an off domain laptop for emergency or diagnostic or debug use.
- AnIdiotOnTheNet 5y ago
  The lesson here is this: if you make it too inconvenient for people to do their jobs, regardless of why, people will work around you to get things done. Effective security policy must take this into account.
  - korethr 5y ago
    I can't upvote this enough. I have worked IT long enough to see some impressive creativity by users to defeat security policies getting in the way of doing their jobs. I have argued that the raison d'etre of security policy is to ensure the existence and continuity of an environment in which work can get done. I've been told about the importance of the C.I.A triad and other things as though they were refutations of my point, often in tones of voice implying an attitude that this not-security|compliance-tech-is-incapable-of-knowing-what-he's-talking-about-and-therefore-can-be-ignored. I counter-argue that C.I.A et. al. are not refutations of my thesis, but in fact support it. If you can't ensure the confidentiality, integrity, and availability of information or systems for yourself or your customers, you do not, and/or will not, have an environment in which work can get done. So, for the love of getting shit done, stop masturbating with broad and blind application of checklists, and take the time to sit down, really look at what you're trying to do and why, and develop actually useful risk models. And then develop security policies against those risk models. Yes checklists and various standards are useful tools that can help you cover a lot of common stuff, but are not the whole picture.
    - SAI_Peregrinus 5y ago
      A bad security policy is an attack on the Availability part of C.I.A. Your security policy definitely shouldn't lead to leaking information or falsifying data, why is it so acceptable to make system availability go to shit?
nine_k 5y ago
According to NIST, quarterly password resets are useless. If your SSO isn't, use a good password manager. Admin access for devs should be audited, and devs should understand that now they need some opsec. Like, separate work and personal machines; if not physically, at least use a different account, better yet, a VM. To say nothing about adding suspicious email / IM attachments. Remember, devs: you are a potential attack vector, a very efficient one.

cartoonworld 5y ago

Damn straight, it's even worse than that though. Blue teams are behind from the start due to the nature of the security landscape. They are further hindered by misguided application of the "move fast and break things" method. You aren't supposed to break your C.I.A. and expose customers and everybody else to huge liabilities. Security needs to be baked into the infrastructure and IT management practices from the start. This requires enforcement, jail, and civil suits. Office of Personnel Management, Ashley Madison, Target and countless other retaikers, Dams and Pipelines and Water, Maersk, Linkedin, all these supply chain hacks and schools and hospitals across the country and the world. This has been going on for decades now, with no accountability at all. It just doesn't seem to be a priority. What in the hell are we doing? Why do MMORPGs have better security than the hospital??