7 ms·

I think this does not acknowledge how incredibly asymmetric the difficulty is on each side. It is expensive and difficult to protect against security breaches,

I think this does not acknowledge how incredibly asymmetric the difficulty is on each side. It is expensive and difficult to protect against security breaches, even with specialised software and expensive dedicated cybersecurity teams. Meanwhile, top-notch offensive capabilities might set you back up to seven figures which is easily achievable by unfriendly regimes (eg Russia, Iran, China, North Korea) or just criminals in places where they have little interference from authorities (eg most ransomware). One small fuckup is sufficient to have the whole thing compromised (though cybersecurity people do live to talk about defence in depth) and security doesn’t compose well. That is, security is a property of the system as a whole and security of individual parts needn’t imply security of the whole. I think analogies to physical security are bad because when you think of physical security you don’t imagine stealthy strangers constantly trying to pick your locks or open your windows or even tailgate people into the office at all times of day or night. But once one has a tool to breach a common system, it can be quickly tried on many systems at little marginal cost. When the marginal cost and risk are low, you may see more attacks. The real difference these days is that cryptocurrencies have made the potential payout high and so there are a lot of incentives to carrying these attacks.

deleted 5y ago
[deleted]
mannykannot 5y ago
It is not clear to me that OP's position fails to acknowledge the difficulties. It is, rather, the tacit assumption that this problem could be mitigated through insurance, in the way that comparatively low-level scams and thefts are, that fails to recognize the magnitude of the threat.
- pfortuny 5y ago
  I am amazed that an insurance company is keen to make such a lose-lose deal, honestly, without proper verification of the capabilities of the insured person. Well, they seem to be learning now.
dcow 5y ago
Engineers aren’t allowed “one small fuckup” when building bridges and buildings. Doctors aren’t allowed “one small fuckup” in the OR or when calculating dosages. These mistakes are grave and should be costly. Pilots aren’t allowed small fuckups when flying planes. The problem is that companies don’t want to invest the time in good security because it’s less profitable. Or, they are old and decrepit. If the company runs critical infrastructure, then peoples’ safety is at risk. If they don’t then surely a new fad can take their place. Why should we tolerate small fuckups and negligence that only serves a company's shareholders’ interests? I do know places that don’t allow random individuals to tail you into a building and have cameras on entryways so you can’t sit there and attempt to pick the lock endlessly. And they have good locks. Just because it’s harder to “see” digital systems doesn't make them any less relevant to secure. People in software more-so on average just don't understand how the internet works so they don’t know where to put the cameras and how to identify the shady individual trying to tail someone through an entryway that requires authorization. This problem is fixable but not when the prime directive is “ship this experimental product as fast as you possibly can or I’ll hire an offshore contractor”. And not when your extent of experience with operating software is running a cute web server on your dev laptop. People are actually doing really dumb shit. Don’t pretend that everyone is writing good software and following best practices and they just happen to get hacked by a script kiddie “oh no”. These are sophisticated actors targeting mature but vulnerable companies that have chosen to selfishly forgo healthy security practices. Again, why do we want these machines participating in society? Why don’t we want them replaced with more secure versions?
- ipaddr 5y ago
  Doctors are allowed many small fuckups and some major. Docotors have insurance and medical associations with the best lawyers.
- sokoloff 5y ago
  > Pilots aren’t allowed small fuckups when flying planes. Pilots are allowed small fuckups all the time when flying planes. I've got around 1500 hours and haven't had a perfect flight yet. When I stop flying, I expect to have 3000 hours and still to not have had a perfect flight. Aviation is designed around having redundancies, tolerances, and contingencies for these small fuckups.
staticassertion 5y ago
> It is expensive and difficult to protect against security breaches, No it isn't, it's super cheap and dead simple. What's expensive and difficult is fixing security problems super late in the game. Undoing bad security is hard. Doing it right is really simple. For example, we have 2FA everywhere at my company. It's 10 people, so that's easy, and it always will be. If we were 2,000 people I'd have to go through hoops and it'd be a whole mess to roll out 2FA everywhere. By using U2F 2FA from day one we've more or less eliminated credential theft as a threat. By disabling app execution we've eliminated malware as a threat. Right off the bat the vast majority of attacks just don't work, and those were trivial to implement. We do way more than that, and it was all dead simple. > One small fuckup is sufficient to have the whole thing compromised It definitely shouldn't be. Companies flat out do not care, in part because there aren't consequences for not caring. Otherwise they'd do something about it. Even if you're on an older network where you've got AD and garbage like that you can do a lot to improve things.
- Closi 5y ago
  > No it isn't, it's super cheap and dead simple. What's expensive and difficult is fixing security problems super late in the game. For example, we have 2FA everywhere at my company. It's 10 people, so that's easy, and it always will be. If we were 2,000 people I'd have to go through hoops and it'd be a whole mess to roll out 2FA everywhere. Lots of companies were founded prior to the popularisation of 2FA, and these security standards change over time. Making new applications secure by modern-day standards might be relatively simple - although you are still exposed to security risks if one of your vendors has a vulnerability (you don't often get to see the codebase of your vendors, so a zero day can hit hard). Then keeping a legacy infrastructure, older codebase or historical on-premise applications (where the vendor may not even exist anymore) secure is more difficult. And all those solutions were 'secure' by the standards of when they were implemented, just times have changed. And then on top of that, we are talking about Ransomware hackers which are buying zero-days for host operating systems - and at that point all bets are off. Let's not forget, you just needed 1 machine of the 2,000 to be 2 months out of date on patches and you were susceptible to WannaCry.
  - 5y ago
RHSeeger 5y ago
> I think this does not acknowledge how incredibly asymmetric the difficulty is on each side. It is expensive and difficult to protect against security breaches, even with specialised software and expensive dedicated cybersecurity teams. I'm curious how much the "locked door" idea comes into play here. Locking your doors doesn't keep out thieves. Rather, it makes you less of a target because you're more difficult than others that didn't lock their doors. Is it reasonable to assume that, the more you protect your system, the less likely you are to be attacked... even if you don't do a perfect job. I would guess the answer is a definitive yes.
indymike 5y ago
> I think this does not acknowledge how incredibly asymmetric the difficulty is on each side. It is expensive and difficult to protect against security breaches, I'm not an security guy, but occasionally, I get asked by a friend that has a big IT problem for a second opinion, and that has happened with ransomware six times in thee last three years. From what I've seen, ransomware attacks are the result of a conspiracy of neglect and a couple global IT mistakes: * Backup/restore doesn't work at all, which is really the story on every ransomware attack I've seen. Testing and verifying operation was neglected. * Services are not partitioned in a way that isolates them from attack. For example, backups are stored on a writable network share leading to the backup being encrypted by the ransomware. This is often because getting access control on a service right takes time, and does make it harder for users when they are doing something out of the ordinary. * User access is read write on everything and uses shared credentials (for example, using the same database user account, with admin rights on all services that touch a database server). This makes it easy for the IT guy, and makes it very easy for the ransomware to spread through the network and take down stuff it shouldn't be able to touch: like the tables for your billing system. * There's a false belief that you can isolate an insecure network for the secure one. This may work (in theory) in a data center where there is ironclad control of what is connected to the network, but in an office environment, this is impossible. Companies who run their internal network like an ISP where nothing is trusted do a lot better. * Out of date server software has massive vulnerabilities and hasn't been updated in years and years. This is often because someone customized something and did not maintain it, and eventually, it became impossible to upgrade. So, the admin leaned in on the belief that they could secure the system at the network level. Insurance companies will have to insist on a few practices if they want to actually be able to sustainably insure against ransomware: * Working backup / restore * No shared admin credentials * Zero trust on the LAN
Rd6n6 5y ago
What backup strategy do you need for ransom ware? I assume you need incremental backups so your newer corrupted files don’t overwrite your older working files?
- Xylakant 5y ago
  Backup software that allows for write-once-never-modify is great in that regard. One of my favorite features of tarsnap: you can separate privileges for writing backups and removing. Introduces a bit of overhead, though.
pid-1 5y ago
I've seen a few successful attacks in wealthy corps and none of them were part of a North Korean plot. Rather they were caused by business still struggling with basic stuff like MFA, password complexity, device management, user permissions, software patching, etc...
- dan-robertson 5y ago
  Right, I don’t really believe the narrative about foreign countries carrying out these attacks. I think they are sufficiently cheap that they can be done by criminals In countries where it is relatively safe for them to act.
TheCoelacanth 5y ago
You can't completely eliminate the risk, but simply having regular backups and actually testing the process for restoring from them to make sure that they work can greatly mitigate the damage from ransomware attacks.
qaq 5y ago
If you think the state of physical security is much better I have some disturbing news for you
everdrive 5y ago
People always talk about how asymmetrical the attack surface is, and I don't disagree with this in principle. However, most companies don't do a lot of the basics: Segment networks, keeps applications and software up to date, keep admin or management interfaces unavailable. The biggest step that I think most companies could benefit from without drastically increasing their cybersecurity spending would simply be to attempt to deploy and use less software and fewer services. Each new piece of software is just waiting to be exploited, waiting to be out of date and forgotten. It'll become part of someone's "necessary" workflow, but it will never be important enough that it's simply kept up to date and managed well. If that software were never there in the first place, the business would simply use some other workflow process, and there would be nothing to be forgotten and exploited.
throwawayay02 5y ago
Then build your company in a way a security vulnerability won't end it. Don't save unnecessary data, don't store everything in the same place, make backups. It being harder is no excuse to making a shody work. "Move fast and break things" is a terrible motto both for the company and clients.
- danielmarkbruce 5y ago
  It's a great moto if it's appropriate. Many companies don't have important data and aren't critical. The great thing about 'move fast and break things' at Facebook was (i don't think they use that anymore...) that it was explicitly what they wanted to do + the downsides they would accept for doing so. An equivalent at a bank might be "be secure and move slowly" - notice how no one says that, ever? They can't stomach the tradeoff they actually need to make. Whose engineering function was more confused as to how to proceed? Early facebook, or Wells Fargo? Being explicit about what you want and what you'll give up for it is a nice thing.
nradov 5y ago
Due to the existence of advanced persistent threats it simply won't be feasible for most small and medium enterprises to maintain their own IT infrastructure anymore. Instead they'll all be forced to outsource to a handful of cloud providers with sufficient scale to maintain a high level of security.

deleted 5y ago

[deleted]

mannykannot 5y ago

It is not clear to me that OP's position fails to acknowledge the difficulties. It is, rather, the tacit assumption that this problem could be mitigated through insurance, in the way that comparatively low-level scams and thefts are, that fails to recognize the magnitude of the threat.

pfortuny 5y ago
I am amazed that an insurance company is keen to make such a lose-lose deal, honestly, without proper verification of the capabilities of the insured person. Well, they seem to be learning now.

dcow 5y ago

Engineers aren’t allowed “one small fuckup” when building bridges and buildings. Doctors aren’t allowed “one small fuckup” in the OR or when calculating dosages. These mistakes are grave and should be costly. Pilots aren’t allowed small fuckups when flying planes. The problem is that companies don’t want to invest the time in good security because it’s less profitable. Or, they are old and decrepit. If the company runs critical infrastructure, then peoples’ safety is at risk. If they don’t then surely a new fad can take their place. Why should we tolerate small fuckups and negligence that only serves a company's shareholders’ interests? I do know places that don’t allow random individuals to tail you into a building and have cameras on entryways so you can’t sit there and attempt to pick the lock endlessly. And they have good locks. Just because it’s harder to “see” digital systems doesn't make them any less relevant to secure. People in software more-so on average just don't understand how the internet works so they don’t know where to put the cameras and how to identify the shady individual trying to tail someone through an entryway that requires authorization. This problem is fixable but not when the prime directive is “ship this experimental product as fast as you possibly can or I’ll hire an offshore contractor”. And not when your extent of experience with operating software is running a cute web server on your dev laptop. People are actually doing really dumb shit. Don’t pretend that everyone is writing good software and following best practices and they just happen to get hacked by a script kiddie “oh no”. These are sophisticated actors targeting mature but vulnerable companies that have chosen to selfishly forgo healthy security practices. Again, why do we want these machines participating in society? Why don’t we want them replaced with more secure versions?

ipaddr 5y ago
Doctors are allowed many small fuckups and some major. Docotors have insurance and medical associations with the best lawyers.
sokoloff 5y ago
> Pilots aren’t allowed small fuckups when flying planes. Pilots are allowed small fuckups all the time when flying planes. I've got around 1500 hours and haven't had a perfect flight yet. When I stop flying, I expect to have 3000 hours and still to not have had a perfect flight. Aviation is designed around having redundancies, tolerances, and contingencies for these small fuckups.

staticassertion 5y ago

> It is expensive and difficult to protect against security breaches, No it isn't, it's super cheap and dead simple. What's expensive and difficult is fixing security problems super late in the game. Undoing bad security is hard. Doing it right is really simple. For example, we have 2FA everywhere at my company. It's 10 people, so that's easy, and it always will be. If we were 2,000 people I'd have to go through hoops and it'd be a whole mess to roll out 2FA everywhere. By using U2F 2FA from day one we've more or less eliminated credential theft as a threat. By disabling app execution we've eliminated malware as a threat. Right off the bat the vast majority of attacks just don't work, and those were trivial to implement. We do way more than that, and it was all dead simple. > One small fuckup is sufficient to have the whole thing compromised It definitely shouldn't be. Companies flat out do not care, in part because there aren't consequences for not caring. Otherwise they'd do something about it. Even if you're on an older network where you've got AD and garbage like that you can do a lot to improve things.

Closi 5y ago
> No it isn't, it's super cheap and dead simple. What's expensive and difficult is fixing security problems super late in the game. For example, we have 2FA everywhere at my company. It's 10 people, so that's easy, and it always will be. If we were 2,000 people I'd have to go through hoops and it'd be a whole mess to roll out 2FA everywhere. Lots of companies were founded prior to the popularisation of 2FA, and these security standards change over time. Making new applications secure by modern-day standards might be relatively simple - although you are still exposed to security risks if one of your vendors has a vulnerability (you don't often get to see the codebase of your vendors, so a zero day can hit hard). Then keeping a legacy infrastructure, older codebase or historical on-premise applications (where the vendor may not even exist anymore) secure is more difficult. And all those solutions were 'secure' by the standards of when they were implemented, just times have changed. And then on top of that, we are talking about Ransomware hackers which are buying zero-days for host operating systems - and at that point all bets are off. Let's not forget, you just needed 1 machine of the 2,000 to be 2 months out of date on patches and you were susceptible to WannaCry.
- 5y ago

RHSeeger 5y ago

> I think this does not acknowledge how incredibly asymmetric the difficulty is on each side. It is expensive and difficult to protect against security breaches, even with specialised software and expensive dedicated cybersecurity teams. I'm curious how much the "locked door" idea comes into play here. Locking your doors doesn't keep out thieves. Rather, it makes you less of a target because you're more difficult than others that didn't lock their doors. Is it reasonable to assume that, the more you protect your system, the less likely you are to be attacked... even if you don't do a perfect job. I would guess the answer is a definitive yes.

indymike 5y ago

> I think this does not acknowledge how incredibly asymmetric the difficulty is on each side. It is expensive and difficult to protect against security breaches, I'm not an security guy, but occasionally, I get asked by a friend that has a big IT problem for a second opinion, and that has happened with ransomware six times in thee last three years. From what I've seen, ransomware attacks are the result of a conspiracy of neglect and a couple global IT mistakes: * Backup/restore doesn't work at all, which is really the story on every ransomware attack I've seen. Testing and verifying operation was neglected. * Services are not partitioned in a way that isolates them from attack. For example, backups are stored on a writable network share leading to the backup being encrypted by the ransomware. This is often because getting access control on a service right takes time, and does make it harder for users when they are doing something out of the ordinary. * User access is read write on everything and uses shared credentials (for example, using the same database user account, with admin rights on all services that touch a database server). This makes it easy for the IT guy, and makes it very easy for the ransomware to spread through the network and take down stuff it shouldn't be able to touch: like the tables for your billing system. * There's a false belief that you can isolate an insecure network for the secure one. This may work (in theory) in a data center where there is ironclad control of what is connected to the network, but in an office environment, this is impossible. Companies who run their internal network like an ISP where nothing is trusted do a lot better. * Out of date server software has massive vulnerabilities and hasn't been updated in years and years. This is often because someone customized something and did not maintain it, and eventually, it became impossible to upgrade. So, the admin leaned in on the belief that they could secure the system at the network level. Insurance companies will have to insist on a few practices if they want to actually be able to sustainably insure against ransomware: * Working backup / restore * No shared admin credentials * Zero trust on the LAN

Rd6n6 5y ago

What backup strategy do you need for ransom ware? I assume you need incremental backups so your newer corrupted files don’t overwrite your older working files?

Xylakant 5y ago
Backup software that allows for write-once-never-modify is great in that regard. One of my favorite features of tarsnap: you can separate privileges for writing backups and removing. Introduces a bit of overhead, though.

pid-1 5y ago

I've seen a few successful attacks in wealthy corps and none of them were part of a North Korean plot. Rather they were caused by business still struggling with basic stuff like MFA, password complexity, device management, user permissions, software patching, etc...

dan-robertson 5y ago
Right, I don’t really believe the narrative about foreign countries carrying out these attacks. I think they are sufficiently cheap that they can be done by criminals In countries where it is relatively safe for them to act.

TheCoelacanth 5y ago

You can't completely eliminate the risk, but simply having regular backups and actually testing the process for restoring from them to make sure that they work can greatly mitigate the damage from ransomware attacks.

qaq 5y ago

If you think the state of physical security is much better I have some disturbing news for you

everdrive 5y ago

People always talk about how asymmetrical the attack surface is, and I don't disagree with this in principle. However, most companies don't do a lot of the basics: Segment networks, keeps applications and software up to date, keep admin or management interfaces unavailable. The biggest step that I think most companies could benefit from without drastically increasing their cybersecurity spending would simply be to attempt to deploy and use less software and fewer services. Each new piece of software is just waiting to be exploited, waiting to be out of date and forgotten. It'll become part of someone's "necessary" workflow, but it will never be important enough that it's simply kept up to date and managed well. If that software were never there in the first place, the business would simply use some other workflow process, and there would be nothing to be forgotten and exploited.

throwawayay02 5y ago

Then build your company in a way a security vulnerability won't end it. Don't save unnecessary data, don't store everything in the same place, make backups. It being harder is no excuse to making a shody work. "Move fast and break things" is a terrible motto both for the company and clients.

danielmarkbruce 5y ago
It's a great moto if it's appropriate. Many companies don't have important data and aren't critical. The great thing about 'move fast and break things' at Facebook was (i don't think they use that anymore...) that it was explicitly what they wanted to do + the downsides they would accept for doing so. An equivalent at a bank might be "be secure and move slowly" - notice how no one says that, ever? They can't stomach the tradeoff they actually need to make. Whose engineering function was more confused as to how to proceed? Early facebook, or Wells Fargo? Being explicit about what you want and what you'll give up for it is a nice thing.

nradov 5y ago

Due to the existence of advanced persistent threats it simply won't be feasible for most small and medium enterprises to maintain their own IT infrastructure anymore. Instead they'll all be forced to outsource to a handful of cloud providers with sufficient scale to maintain a high level of security.