5 ms·

This is something I think about a lot when I glance over the constant daily penetration scans on my small self-hosted website's logs. We would obviously care a

This is something I think about a lot when I glance over the constant daily penetration scans on my small self-hosted website's logs. We would obviously care and do something about people streaming (physically) through neighborhoods to test every door/window/mailbox on every building. For some reason, when it comes to the metaphorical "buildings" of our digital spaces, the general consensus seems to be a half-sarcastic: "If you can't install and maintain impenetrable state-of-the-art locks on all your stuff, you had better just give up and move into the Facebook highrise."

markzzerella 5y ago
Your neighborhood isn't globally accessible in milliseconds with near complete anonymity. To expect that there won't be attacks is fanciful. To be operating in the 7 figure revenue range without even looking up best practices is negligence.
- shuntress 5y ago
  That is exactly my point. We have systems in place to deal with people going door-to-door trying to open the windows on each house down my street. The police are eager to fly through red lights and get here as fast as possible to fight crime. (Equity in policing is a different discussion but the point here is that the system exists) But for the electronic equivalent, we have no system.
hpoe 5y ago
The disconnect isn't that we require people to have state of the art impenetrable locks, we are requiring them merely to lock the door when they are out. These standards that are out there aren't difficult to implement or put in place. For example if we look at PCI-DSS standards some of them include 1 - Changing default passwords 2 - Having a firewall 3 - Encrypting PCI information at rest 4 - Using encrypted communication channels for PCI (https). This is just some of the standards and none of them are very hard, all of them are trivial to implement. So sure it's a bad thing if you get robbed while out on errands, but you're going to get a whole lot less sympathy if it turns out you left the front door open with a sign that said, "I'm not home right now." EDIT: To be clear I am not talking about SMB mom and pop shops necessarily in this comment, I am talking about the massive Fortune 1000 companies that are getting hit with this over and over again.
- kradeelav 5y ago
  Trivial to an infosec professional, sure, but what about the artists, the wordpress cpanel hosters like me that can rig up a site using html/css but doesn't dare to host anything more dynamic knowing full well there'll be security holes? There's a huge gap in technical skill from "can get an interactive site online" front-end-ish perspective versus a back end professional.
- shuntress 5y ago
  > The disconnect isn't that we require people to have state of the art impenetrable locks, we are requiring them merely to lock the door when they are out. This is missing the point. My doors are locked and (as far as I can tell) the locks have not been defeated. My problem is with the constant attempts to defeat the locks on my door and with people like you telling me things like > "you're going to get a whole lot less sympathy if it turns out you left the front door open with a sign that said, "I'm not home right now."" when what I'm complaining about is that robbers are banging on my locked door while I am behind it watching them on the security camera.
citrin_ru 5y ago
> We would obviously care and do something about people streaming (physically) through neighborhoods to test every door Not obviously. Burglary/theft clearance rates are very low (in most countries). At least in developed countries violent crimes have highest priority and small property crimes are almost ignored. I doubt police will do anything meaningful if you report a person who is going door to door and checking if they are open.

markzzerella 5y ago

Your neighborhood isn't globally accessible in milliseconds with near complete anonymity. To expect that there won't be attacks is fanciful. To be operating in the 7 figure revenue range without even looking up best practices is negligence.

shuntress 5y ago
That is exactly my point. We have systems in place to deal with people going door-to-door trying to open the windows on each house down my street. The police are eager to fly through red lights and get here as fast as possible to fight crime. (Equity in policing is a different discussion but the point here is that the system exists) But for the electronic equivalent, we have no system.

hpoe 5y ago

The disconnect isn't that we require people to have state of the art impenetrable locks, we are requiring them merely to lock the door when they are out. These standards that are out there aren't difficult to implement or put in place. For example if we look at PCI-DSS standards some of them include 1 - Changing default passwords 2 - Having a firewall 3 - Encrypting PCI information at rest 4 - Using encrypted communication channels for PCI (https). This is just some of the standards and none of them are very hard, all of them are trivial to implement. So sure it's a bad thing if you get robbed while out on errands, but you're going to get a whole lot less sympathy if it turns out you left the front door open with a sign that said, "I'm not home right now." EDIT: To be clear I am not talking about SMB mom and pop shops necessarily in this comment, I am talking about the massive Fortune 1000 companies that are getting hit with this over and over again.

kradeelav 5y ago
Trivial to an infosec professional, sure, but what about the artists, the wordpress cpanel hosters like me that can rig up a site using html/css but doesn't dare to host anything more dynamic knowing full well there'll be security holes? There's a huge gap in technical skill from "can get an interactive site online" front-end-ish perspective versus a back end professional.
shuntress 5y ago
> The disconnect isn't that we require people to have state of the art impenetrable locks, we are requiring them merely to lock the door when they are out. This is missing the point. My doors are locked and (as far as I can tell) the locks have not been defeated. My problem is with the constant attempts to defeat the locks on my door and with people like you telling me things like > "you're going to get a whole lot less sympathy if it turns out you left the front door open with a sign that said, "I'm not home right now."" when what I'm complaining about is that robbers are banging on my locked door while I am behind it watching them on the security camera.

citrin_ru 5y ago

> We would obviously care and do something about people streaming (physically) through neighborhoods to test every door Not obviously. Burglary/theft clearance rates are very low (in most countries). At least in developed countries violent crimes have highest priority and small property crimes are almost ignored. I doubt police will do anything meaningful if you report a person who is going door to door and checking if they are open.