3 ms·

Penalties for insufficient security controls, for starters.

logicalmonster 5y ago
What exactly is “sufficient security controls”? This is the type of thing that sounds good on the surface, but becomes nightmarish when you start to think about how it might work in practice. Experts disagree on how to do security. For instance, there’s still some people who insist that complex password rules are a genius idea that makes the world far safer, yet they’re unambiguously bad for security because they knowingly decrease the number of possible password combinations. Whose idea of best practices wins? I’d hate that the decision now becomes a dictate by some bureaucracy that likely barely knows what the hell is going on.
- Ansil849 5y ago
  You're acting like there are no established security controls for financial institutions. There are.
  - logicalmonster 5y ago
    Maybe so. But my bank still does 2 Factor Authentication only through SMS and doesn’t even offer some kind of Authentication App as an option. Additionally they have strict password rules in place, a basically broken password reset form, and a comically short maximum password limit. Color me not impressed with whatever rules do exist.
    - Ansil849 5y ago
      It's not "maybe so", it's a matter of fact. And we're not talking about outdated user-facing login authentication procedures, we're talking about securing the back-end. When is the last time your bank had $150 million stolen?
      - logicalmonster 5y ago
        I don’t know how my bank implements their backend. Based on the parts I can see that I mentioned, I’m not very impressed with their interpretation of best practices. That’s a good question. I don’t know how often banks get robbed of cash due to digital intrusions. I have gotten credit card info stolen before and that happens with many people, so maybe errors in the banking system more commonly take the form of lots of small fraud rather than a few big events.
        Daishiman 5y ago
        So if you don't know, how can you be unimpressed?
        logicalmonster 5y ago
        As I said, I don't have proof about parts I can't see and never claimed so. But the parts I can see are IMO bad, so it's reasonable to be skeptical about the parts I can't see. Also, I haven't worked with my actual bank, but I've done multiple bits of consulting in the past on some other national bank's technology, and my time there was such a disorganized mess that I have to doubt the quality of all of their systems and practices.
      - logicalmonster 5y ago
        Also as an additional followup comment, the legal structure surrounding banks probably impacts how digital robberies are targeted as well. A cyber-criminal organization who wants to rob some big player like Goldman Sachs, BlackRock, or Citibank of 9+ figures probably knows that they're going to have a devil of a time getting away with any big-time theft. The US government is actually going to go after anybody who tries to pull money out of big banks accounts to the point that they might even be willing to go to war in the right circumstance. If you're a cyber criminal, even if you could hack into some big bank systems and force a transfer, how would you get away with the cash in most cases? If they really target you with their full weight, you're probably completely screwed. In comparison, random Crypto Financial Agents are on many power-players "Naughty List". Depending on the exact circumstances of some crypto-robbery, the full weight of the US Government probably isn't going to be deployed against some cyber criminal organization who manages to take out a crypto firm's assets in the same way that they would if you targeted the existing banks. So maybe relatively more cyber attacks happen against crypto than other types of assets because it's known as a safer target. (I have no clue, this is just a reasonable hypothesis to me)
    - lanstin 5y ago
      Yet they seem to prevent banks from having all their stored value exfiltrated. of all my worries about my credit union, them having all their money shipped of to an anonymous crypto wallet obfuscator is not one. I can manage the risks of systems i interact with directly, but some non zero chance of the assets disappearing i cannot manage
    - Daishiman 5y ago
      User-facing security is just the tip of the iceberg for bank security, and IMO one of the less important factors. You have regulations like CPI on how to store credit card credentials, transaction history, and audit logging. You have regulations on physical access and who's allowes to touch production. There's enormous amounts of regulation on auditing and software that's permitted to generate bank transactions. Having worked in the space I am definitely impressed; it's taken very seriously, there are real, concrete consequences for not taking is seriously, and you generally don't see retail banks failing because someone messed around with ACH transactions, for example.

What exactly is “sufficient security controls”? This is the type of thing that sounds good on the surface, but becomes nightmarish when you start to think about how it might work in practice. Experts disagree on how to do security. For instance, there’s still some people who insist that complex password rules are a genius idea that makes the world far safer, yet they’re unambiguously bad for security because they knowingly decrease the number of possible password combinations. Whose idea of best practices wins? I’d hate that the decision now becomes a dictate by some bureaucracy that likely barely knows what the hell is going on.

Ansil849 5y ago
You're acting like there are no established security controls for financial institutions. There are.
- logicalmonster 5y ago
  Maybe so. But my bank still does 2 Factor Authentication only through SMS and doesn’t even offer some kind of Authentication App as an option. Additionally they have strict password rules in place, a basically broken password reset form, and a comically short maximum password limit. Color me not impressed with whatever rules do exist.
  - Ansil849 5y ago
    It's not "maybe so", it's a matter of fact. And we're not talking about outdated user-facing login authentication procedures, we're talking about securing the back-end. When is the last time your bank had $150 million stolen?
    - logicalmonster 5y ago
      I don’t know how my bank implements their backend. Based on the parts I can see that I mentioned, I’m not very impressed with their interpretation of best practices. That’s a good question. I don’t know how often banks get robbed of cash due to digital intrusions. I have gotten credit card info stolen before and that happens with many people, so maybe errors in the banking system more commonly take the form of lots of small fraud rather than a few big events.
      - Daishiman 5y ago
        So if you don't know, how can you be unimpressed?
        logicalmonster 5y ago
        As I said, I don't have proof about parts I can't see and never claimed so. But the parts I can see are IMO bad, so it's reasonable to be skeptical about the parts I can't see. Also, I haven't worked with my actual bank, but I've done multiple bits of consulting in the past on some other national bank's technology, and my time there was such a disorganized mess that I have to doubt the quality of all of their systems and practices.
    - logicalmonster 5y ago
      Also as an additional followup comment, the legal structure surrounding banks probably impacts how digital robberies are targeted as well. A cyber-criminal organization who wants to rob some big player like Goldman Sachs, BlackRock, or Citibank of 9+ figures probably knows that they're going to have a devil of a time getting away with any big-time theft. The US government is actually going to go after anybody who tries to pull money out of big banks accounts to the point that they might even be willing to go to war in the right circumstance. If you're a cyber criminal, even if you could hack into some big bank systems and force a transfer, how would you get away with the cash in most cases? If they really target you with their full weight, you're probably completely screwed. In comparison, random Crypto Financial Agents are on many power-players "Naughty List". Depending on the exact circumstances of some crypto-robbery, the full weight of the US Government probably isn't going to be deployed against some cyber criminal organization who manages to take out a crypto firm's assets in the same way that they would if you targeted the existing banks. So maybe relatively more cyber attacks happen against crypto than other types of assets because it's known as a safer target. (I have no clue, this is just a reasonable hypothesis to me)
  - lanstin 5y ago
    Yet they seem to prevent banks from having all their stored value exfiltrated. of all my worries about my credit union, them having all their money shipped of to an anonymous crypto wallet obfuscator is not one. I can manage the risks of systems i interact with directly, but some non zero chance of the assets disappearing i cannot manage
  - Daishiman 5y ago
    User-facing security is just the tip of the iceberg for bank security, and IMO one of the less important factors. You have regulations like CPI on how to store credit card credentials, transaction history, and audit logging. You have regulations on physical access and who's allowes to touch production. There's enormous amounts of regulation on auditing and software that's permitted to generate bank transactions. Having worked in the space I am definitely impressed; it's taken very seriously, there are real, concrete consequences for not taking is seriously, and you generally don't see retail banks failing because someone messed around with ACH transactions, for example.