4 ms·

If a bridge collapses, we don't get upset that the police weren't forming ranks by the bridge to keep the water away. Software is more like bridges than stores

If a bridge collapses, we don't get upset that the police weren't forming ranks by the bridge to keep the water away. Software is more like bridges than stores. It's supporting infrastructure that needs to be able to withstand reasonably anticipated forces of nature. We expect buildings to be able to resist termite damage by taking reasonable means to block them. We should also expect software to resist self-propagating worms and other attacks. If you build a building in a tough neighborhood (or a warzone), that building has to have security and stability features that match the demands placed on it by its environment. The Internet is basically a termite-infested warzone. We know that threats exist, we have things like OWASP and other sources of improving best practices to prevent common entrypoints for attacks. We have to expect software and networks to do better, just as we expect governments to find and stop the attackers.

dahfizz 5y ago
> It's supporting infrastructure that needs to be able to withstand reasonably anticipated forces of nature. Hackers are not a force of nature, they are criminals. This is absolutely no different than someone picking the lock to your front door and stealing all you own. Even if you forgot to lock your door, or failed to install steal bars over your windows, its still not your fault if your house is broken into.
- dijit 5y ago
  If I hire you to secure my house and you remove my front door- you are liable. Kaseya is a security services company, they’re the ones securing the home, they removed the front door.
  - shuntress 5y ago
    Most people (at least, that I know) do not hire private security teams to police their homes. And the ones that do pay companies for security typically stop at surveillance (cameras, motion detectors, door detectors, etc). These only help to prevent intrusion with the threat of detection (the intruders recognizable face on camera). Most private buildings are not hardened fortresses capable of state-of-the-art attacks and I personally don't think it's reasonable to expect them to be.
    - dijit 5y ago
      Sure, people don't, or at least the kind of people I associate with don't: companies do though. This was a company hiring a security firm.
- theptip 5y ago
  A good analogy might be germs. It's probably not reasonable to expect most businesses to have a plan to handle a global pandemic, or to vaccinate the public against seasonal endemics. But it's probably reasonable to expect most businesses to be aware of germs and take appropriate measures to handle and protect against them. Hospitals being very sensitive to germs, should have strong sanitation protocols. Food processing, likewise. The government should regulate this. A factory making cars, maybe less regulation is required, though a general baseline prohibition on unsanitary working environments makes sense. I'd say in the current threat environment, hacking/phishing attempts are closely analogous to the baseline level of attacks that our immune systems are subjected to. Countries that harbor hackers could be analogized to dumping effluent into a river up-stream of a city; it's probably the government's job to clean that up. But also, if the river is unsanitary, in the meantime it's reasonable to be critical of companies that obliviously use it for rinsing vegetables. Under this analogy, it's both reasonable to expect companies to be aware of germs and take precautions against them, since they are a fact of the environment, and also to want the government to take the lead on cleaning up egregious sources of germs, since that's not something any individual actor could do on their own.
  - shuntress 5y ago
    It is better to compare digital crime to that which is more similar: Physical crime. Unlike germs, these attacks are carried out deliberately by people. Not instinctively by some animal or natural force.
    - theptip 5y ago
      Ok, and how would you apply your comparison to the conversation we're having here?
      - shuntress 5y ago
        The core difference in the comparisons is that one treats the issue as a natural force that simply exists in the world and acts upon society externally. The other treats the issue as human aspect of society that acts from within. Someone accused of "hacking" (Ransomware, spam, stolen credit cards, etc) may be brought to court to explain themselves, bring in (or implicate) their clients, present evidence, be judged, etc. That is the best process we have for dealing with crime and is why comparing hacking to germs is sidestepping an important part of the discussion. Edit: To answer your actual question, I would say a more apt comparison would be to basic breaking & entering robbery. In the physical world it doesn't make sense for every building to have 2ft thick concrete walls, blast doors, iron bars, and complex locks that can defeat the most advanced techniques for breaking & entering because most robbers will not have access to those techniques and the ones that do will either be interested in other targets or deterred by the systems in place that prevent them from bringing these techniques to bear against some random gas station cash register. The problem, as I see it, described with this analogy is that the robbers (or "hackers" here) are empowered to be much less discriminating regarding their targets. To stay within this analogy, on a technical level the tools one would use for stealing from a bank vault are used just as easily to steal from a gas station cash register.
- markzzerella 5y ago
  The internet is global, freely accessible WiFi is covering every city on the planet, and sub $50 single board computers that use so little power they can run off small solar panels are ubiquitous. Hackers are absolutely to be expected like a force of nature and to think they aren't is pure fantasy. If you are making millions of dollars but can't manage first year student level security or anything approaching best practices then you get what's coming to you.
- hnick 5y ago
  Sure, but banks have vaults. There's a continuum on what is reasonable against known risks. No one would accept a bank saying not to victim blame if they had no security. We know they are targets. Unfortunately, enforcement online is an international sovereignty issue, so everyone is a target due to high reward and low risk. Until changes are made we must be responsible for our own security. We can still blame attackers at the same time.
edouard-harris 5y ago
There's a key difference: if you build a building to resist termite damage, the termites don't retreat, plan their next attack, and come back with drills and wood saws to try again. Hackers are better modeled as intelligent adversaries than as forces of nature, because as attackers, they actively improve their techniques as the defenders do. That means they won't be stopped for long by static infrastructure. And in the same way, "best practices" are a moving target, so they'll always be applied unevenly across companies at any given point in time. In fact, the more economically damaging the hack, the truer this is: the biggest ransoms and the greatest national security risks are mostly caused by actors that employ dozens or hundreds of motivated professionals to find gaps in an organization's infrastructure. And that means the "force of nature" model is especially inaccurate when we weigh incidents by economic impact (which arguably we ought to do). Wee know exactly one way of blocking intelligent, motivated adversaries from getting what they want at our expense. And that's to have at least equally motivated, at least equally intelligent folks on the other side who are continually trying to stop them. And that doesn't sound entirely unlike a fairly reasonable line item in a national defense budget.

dahfizz 5y ago

> It's supporting infrastructure that needs to be able to withstand reasonably anticipated forces of nature. Hackers are not a force of nature, they are criminals. This is absolutely no different than someone picking the lock to your front door and stealing all you own. Even if you forgot to lock your door, or failed to install steal bars over your windows, its still not your fault if your house is broken into.

dijit 5y ago
If I hire you to secure my house and you remove my front door- you are liable. Kaseya is a security services company, they’re the ones securing the home, they removed the front door.
- shuntress 5y ago
  Most people (at least, that I know) do not hire private security teams to police their homes. And the ones that do pay companies for security typically stop at surveillance (cameras, motion detectors, door detectors, etc). These only help to prevent intrusion with the threat of detection (the intruders recognizable face on camera). Most private buildings are not hardened fortresses capable of state-of-the-art attacks and I personally don't think it's reasonable to expect them to be.
  - dijit 5y ago
    Sure, people don't, or at least the kind of people I associate with don't: companies do though. This was a company hiring a security firm.
theptip 5y ago
A good analogy might be germs. It's probably not reasonable to expect most businesses to have a plan to handle a global pandemic, or to vaccinate the public against seasonal endemics. But it's probably reasonable to expect most businesses to be aware of germs and take appropriate measures to handle and protect against them. Hospitals being very sensitive to germs, should have strong sanitation protocols. Food processing, likewise. The government should regulate this. A factory making cars, maybe less regulation is required, though a general baseline prohibition on unsanitary working environments makes sense. I'd say in the current threat environment, hacking/phishing attempts are closely analogous to the baseline level of attacks that our immune systems are subjected to. Countries that harbor hackers could be analogized to dumping effluent into a river up-stream of a city; it's probably the government's job to clean that up. But also, if the river is unsanitary, in the meantime it's reasonable to be critical of companies that obliviously use it for rinsing vegetables. Under this analogy, it's both reasonable to expect companies to be aware of germs and take precautions against them, since they are a fact of the environment, and also to want the government to take the lead on cleaning up egregious sources of germs, since that's not something any individual actor could do on their own.
- shuntress 5y ago
  It is better to compare digital crime to that which is more similar: Physical crime. Unlike germs, these attacks are carried out deliberately by people. Not instinctively by some animal or natural force.
  - theptip 5y ago
    Ok, and how would you apply your comparison to the conversation we're having here?
    - shuntress 5y ago
      The core difference in the comparisons is that one treats the issue as a natural force that simply exists in the world and acts upon society externally. The other treats the issue as human aspect of society that acts from within. Someone accused of "hacking" (Ransomware, spam, stolen credit cards, etc) may be brought to court to explain themselves, bring in (or implicate) their clients, present evidence, be judged, etc. That is the best process we have for dealing with crime and is why comparing hacking to germs is sidestepping an important part of the discussion. Edit: To answer your actual question, I would say a more apt comparison would be to basic breaking & entering robbery. In the physical world it doesn't make sense for every building to have 2ft thick concrete walls, blast doors, iron bars, and complex locks that can defeat the most advanced techniques for breaking & entering because most robbers will not have access to those techniques and the ones that do will either be interested in other targets or deterred by the systems in place that prevent them from bringing these techniques to bear against some random gas station cash register. The problem, as I see it, described with this analogy is that the robbers (or "hackers" here) are empowered to be much less discriminating regarding their targets. To stay within this analogy, on a technical level the tools one would use for stealing from a bank vault are used just as easily to steal from a gas station cash register.
markzzerella 5y ago
The internet is global, freely accessible WiFi is covering every city on the planet, and sub $50 single board computers that use so little power they can run off small solar panels are ubiquitous. Hackers are absolutely to be expected like a force of nature and to think they aren't is pure fantasy. If you are making millions of dollars but can't manage first year student level security or anything approaching best practices then you get what's coming to you.
hnick 5y ago
Sure, but banks have vaults. There's a continuum on what is reasonable against known risks. No one would accept a bank saying not to victim blame if they had no security. We know they are targets. Unfortunately, enforcement online is an international sovereignty issue, so everyone is a target due to high reward and low risk. Until changes are made we must be responsible for our own security. We can still blame attackers at the same time.

edouard-harris 5y ago

There's a key difference: if you build a building to resist termite damage, the termites don't retreat, plan their next attack, and come back with drills and wood saws to try again. Hackers are better modeled as intelligent adversaries than as forces of nature, because as attackers, they actively improve their techniques as the defenders do. That means they won't be stopped for long by static infrastructure. And in the same way, "best practices" are a moving target, so they'll always be applied unevenly across companies at any given point in time. In fact, the more economically damaging the hack, the truer this is: the biggest ransoms and the greatest national security risks are mostly caused by actors that employ dozens or hundreds of motivated professionals to find gaps in an organization's infrastructure. And that means the "force of nature" model is especially inaccurate when we weigh incidents by economic impact (which arguably we ought to do). Wee know exactly one way of blocking intelligent, motivated adversaries from getting what they want at our expense. And that's to have at least equally motivated, at least equally intelligent folks on the other side who are continually trying to stop them. And that doesn't sound entirely unlike a fairly reasonable line item in a national defense budget.