7 ms·

Which is harder: sneaking across the US border anywhere or preventing anyone from sneaking across the US border everywhere? Sure seems like a 1000:1 problem to

• pwnguin 5y ago
  What stops someone from designing a blue team technique that is just red team techniques applied to your own product prior to release? I suspect MS does exactly that, but red team productivity varies.
  • thaumasiotes 5y ago
    Nothing stops that; it is one of the most routine things you could do. NCC Group exists to provide this service. HackerOne exists to provide this service. Having an external team periodically attempt to penetrate your defenses is legally required for anyone who processes payment card information (in the US; I don't know what PCI requirements are like elsewhere).
  • bostik 5y ago
    This is known as "purple teaming". You have security team segments actively trying to attack your own systems, using both established tooling/techniques, but also developing bespoke attacks that are specific to your systems. Then, and this is crucial, they not only teach the blue team from their findings - they also rotate out to blue teams, to become the defenders themselves. At the same time, some of the blue team rotates in. Rinse and repeat. The whole point is that you have to understand both sides properly, and continuously work with the teams involved. Otherwise you're nothing more than a consultant.
  • dr-detroit 5y ago
    MS are too busy "revitalizing their culture" throwing out their computers for linux/mac and hiring devs for minimum industry wage creating pseudo-electron apps that don't even work in other words sudo-apt-getting sh*t done they dont have time for that egghead stuff.
• echelon 5y ago
  Bit of an aside, but it's only a "1000:1" problem because - The response can't have a blast radius - Human software systems can't be formally verified in a tractable amount of time - etc. I'd go as far as to wager that if it weren't for MAD, the US might be sending SEAL or Special Forces teams in to deal with hackers. When we have an AGI, perhaps it will develop systems impervious to intrusion. Or maybe it'll take the simpler approach and eradicate all humans and other capable AI actors. This is expensive because it's guerrilla warfare.
  • Retric 5y ago
    At one point we came relatively close to using a nuke to deal with a hacking attempt, though taking down NORAD is going to get people nervous. Not everyone can respond to hackers by building an independent global network, but it is one model.
    • jay3ss 5y ago
      > At one point we came relatively close to using a nuke to deal with a hacking attempt Do you have a source on this? Sounds like an interesting read
      • Retric 5y ago
        Unfortunately it was a first hand account, solar sunrise 1998 was the event but many of the details aren’t exactly public. The critical bits where it was being routed through a compromised machine in Baghdad, many DoD systems where running email alongside more mission critical applications, and the timing was the lead up to the first Iraq war.
    • ClumsyPilot 5y ago
      "At one point we came relatively close to using a nuke to deal with a hacking attempt" That sounds like wet dream of a genocidal maniac. There is no way this claim is credible
      • 5y ago
• mikewarot 5y ago
  It has been within our technical capabilities to totally seal off the land border since WWII. What is lacking is the will to do so. There are many reasons we let the borders leak, that aren't too hard to figure out. Seismic, Infrared, Radar, and other monitoring systems could be deployed and ALL land crossings would be known soon enough to stop anyone crossing. Of course, a shoot on sight order is the part nobody has the stomach for, nor should they, we're not at war. Naval patrols could greatly curtail routing around the ends. Capability based security could greatly curtail the leverage you get from access to a given computer. The current default access systems we're using everywhere are about as effective as building a fortress out of crates of C-4 explosive.
  • kondylotha 5y ago
    mikewarot - "Of course, a shoot on sight order is the part nobody has the stomach for, nor should they, we're not at war." "Shoot on sight" has been the *de facto* standing order for most borders. It should be revived again because it will be necessary (e.g., Hungary, southern USA, etc.). No war is required.
  • ygjb 5y ago
    This is such a ridiculous comment. It has never been in the technical capabilities to seal off any land border in the history of humanity, because any controls that you can put in place, including all of the technology that currently exists that you could throw at it are still designed by humans, require absolutely no collaboration on the part of the operators of those defenses, and are immediately upon deployment subject to attack by your adversaries. Assuming you are referring to the United States, even if you deployed all of those sensors at all crossings, it would not be sufficient to deter crossings; those only provide detective capabilities. Yes, you would radically increase the number of people guarding the border, but that would also require a radical investment in enforcement, and such an investment would bankrupt the country for no real practical effect. Even if you did fund and build it, the maintenance costs of preserving the effectiveness of such a land border along the northern border with Canada means protecting a nearly 9,000 km border that about 200 km from the West Coast turns into extremely inhospitable to hostile terrain and climate for a minimum of three to four months out of the year. This terrain is absolutely awful to stalk and patrol in, but is a pleasure to sneak through (at least I really enjoyed it back in my hunting and military training days :D) It is not feasible to scale the navy to the point where it would be practical to prevent access to the continental United States, for example, let alone the island territories. Attempting to do so would bankrupt the nation. Hell, modern technology can't even reliably prevent folks from bobbing over from Cuba despite the relatively small attack surface there. Even if you managed to invest more than the current percentage of GDP (which is already ridiculous), you would also have to confront an increasingly hostile domestic population who is used to freedom of movement, is already paying punishingly high taxes in contrast to the value and benefit they receive for them, and rapidly diminishing quality of life. Good luck with that! Oh, and one last note about capability based security - it works great in lab and somewhat small environments, but I would appreciate a practical explanation of how you would scale up capability based security to an environments operating in 87 distinct countries (with disparate regulatory requirements that preclude centralized management), 3600 offices, and 800,000 employees, with approximately one third of those employees having employer managed devices, notebooks, and managing a total of 2,300 distinct software applications (granted it's been about 14 years since I worked in that environment, but that company has grown substantially since then). I'm listening for a real, practical suggestion here, not being facetious.
• adolph 5y ago
  Yes. Times must be right: Blue team: every time Red team: once
  • gonzo41 5y ago
    Scope of disaster is important. Keys to the kingdom style fails are always bad
  • rafale 5y ago
    Yeah but the bad guys need to perfect all the time to avoid law enforcement and going to jail. Unless you are state backed that is.
    • adolph 5y ago
      For sure any red team needs a blue game if only from other red teams. Red team is still advantaged in this regard by blue team’s relatively lit up profile.
    • kelnos 5y ago
      I think the point is that there might be a bunch of independent bad guys, but there is only one "you". You're not allowed to make a mistake, ever. Ten bad guys could get caught, but if the 11th breaks in, you lose. They only need to get lucky once.
  • deleted 5y ago
    [deleted]