5 ms·
What does "the most determined attackers" mean in this context? Are we talking the real most determined attackers like the US or China who can easily deploy $1
by Veserv 5y ago
What does "the most determined attackers" mean in this context?
Are we talking the real most determined attackers like the US or China who can easily deploy $10B (i.e. a team of ~3,000 people fulltime for 3 years) for a strategic advantage?
Or $1B (i.e. ~300 people for 3 years) which is within reach of every government, international criminal organization, and thousands of multinationals?
Or $100M (i.e. ~30 people for 3 years) which is now just a line item for those organizations?
Or $10M (i.e. ~3 people for 3 years) which is 10x better than the "gold standard" used by every other bank in the world, but still profitable for small criminal outfits doing ransomware attacks?
Are there any legally binding marketing statements made by any associated security executive on where they sit in these 4 orders of magnitudes of "most determined attackers"?
It is frankly absurd that we continue to allow statements like "secure", "reasonably secure", "most determined", or whatever without expecting some degree of quantification within 4(!) orders of magnitude. If you can not quantify or demarcate an accurate lower bound within 4 orders of magnitude you probably have no idea what you are doing.
- deleted 5y ago[deleted]
- Nextgrid 5y agoWhen it comes to a bank (especially one mostly centered on the UK; Monzo still has very little international capabilities), I don't think state-sponsored attackers are a major problem. Those rarely need the money, and as I mentioned previously Monzo doesn't routinely do international/SWIFT transfers (if they can at all) so getting the money out would be tricky.
- insomniacity 5y agoThey’re still a target if an individual they’re targeting (to harass, find or discredit) banks there. They’re still a target for someone wanting to cause disruption or engage in hybrid warfare - imagine a simultaneous hack of all the neobanks, possibly followed by a few of the traditional banks a week later for maximum impact? They’re still a target for someone wanting to pivot into other organisations they might be connected to, such as card networks or regulators.
- philipswood 5y agoIt's not much fun when your risk model actually, realistically includes a nation state level hacking attempts to disrupt or pervert your services.
- WaitWaitWha 5y ago> ... I don't think state-sponsored attackers are a major problem ... The small and new nature of the Monzo makes it an attractive target. An attacker may well use slightly smaller, slightly less established business to other, more established businesses, as a pivot point. Since this is a 'bank' it will have some connection with other institutions. It does not need to be SWIFT or similar to be exploited. > ... don't think state-sponsored attackers are a major problem. Those rarely need the money ... I disagree with this too. State-sponsored APTs may very well take advantage of financial gains, both to enrich the attacking country, and throw off investigations. (e.g. DPRK, Iran) Just my opinion.
- mox1 5y agoNorth Korea would like a word with you.
- d0mine 5y agoIn a world where a bank robbery is called “identity theft,” why would the care? All they need is security theater.
- gnufx 5y agoAs put best by a comedian or two for those who haven't come across it before: https://www.theguardian.com/commentisfree/2018/nov/25/identity-theft-is-daylight-robbery-banks https://www.theguardian.com/commentisfree/2018/nov/25/identi... https://www.theguardian.com/commentisfree/2018/nov/25/identity-theft-is-daylight-robbery-banks https://www.theguardian.com/commentisfree/2018/nov/25/identi...
- deleted 5y ago[deleted]
- tralarpa 5y ago> $10M (i.e. ~3 people for 3 years) Where can I apply?
- 0xcccccc 5y agoIf you have >$100M and >3years to burn, WTF are you doing robbing a bank?
- __MatrixMan__ 5y agoYou're probably not robbing it. You're probably in charge of a government-backed digital currency and out to make alternatives look unreliable.
- AnthonyMouse 5y agoOr you're after the data. Think about how much information there is in having everybody's financial records. Industrial espionage. Blackmail. Unmasking informants or undercover law enforcement. It's kind of a disaster that they even collect this stuff.
- stavros 5y agoThat's why I try to use cash whenever I can. The less data I generate, the better.
- yobbo 5y agoProbably for blackmail of some sort.
- zaphirplane 5y agoI don’t think every blog, press release needs to be explicit and quantify to that level. Distracting from the main message going down some rabbit hole of how was that 12.67b over 3.67 years calculated