4 ms·

Ransomware is the biggest nightmare I'm seeing. Everything connected to a company network is having to be audited for patches and approved OS installs. IT needs

Ransomware is the biggest nightmare I'm seeing. Everything connected to a company network is having to be audited for patches and approved OS installs. IT needs to have root access to every system. Any system not approved to be networked will be isolated at the switch to knock off the network and that team's other IT systems will be knocked off too. Security just went least privilege for network access where I work. This is especially prevalent to VMs and containers. Anything with an IP address is being audited. Anything.

3pt14159 5y ago
Good. We're finally, FINALLY getting some pressure to fix all these broken systems. I was literally losing sleep over some of the crazy shit I saw. It's still a tire fire, but at the very least there is some movement to fix it.
- mrweasel 5y ago
  A lot of people don’t understand how much gruft is in IT. While I doubt it, my hope for the new year is that business will slow down and shift focus. Rather than building ever more complex system, for what ever reason, perhaps we can now focus on simpler and more secure solution. The collective memory of our industry is shockingly short. If Log4J has taught me anything it is that the old meme: “LOL; It OPSs problem now” is very much still all too real.
- unethical_ban 5y ago
  I'll miss the good old days where our lab environment was never looked at by security or IT. I was a firewall admin at a F100 bank and we had some linux servers we used to do automation against our production firewall systems. We did some of the best, most secure work we ever did because we had access to scripting systems and Python. We built a host of auditing, ops, and secure automation and cleanup tools. It took months if not literally a year or more to convince all the right "stakeholders" that we need a prod server for such a purpose. Same reason we used Bottle.py for our web GUI: We didn't have to install it; it ran on system Python install. I also remember standing up Dokuwiki because our company was two years away from deploying Confluence (puke), and remember setting up Gitlab in a lab environment two years before we got Gitlab, because we only had... some IBM version control, all the tooling and regs around it were built around enterprise product development, not backend. In other words, shadow IT led us to be a more secure organization. It seems IT in the 2020s is getting a clue when it comes to deployment, and now that they have automated everything from deploy to scan, it isn't such a huge ask to get a linux server with which to program. Maybe shadow IT won't be needed anymore. Then again, perfect enforcement of laws is a dangerous thing in society. Maybe too in cyber?
- Zababa 5y ago
  I don't know much about computer security. Is this a domain where you can fix something that was broken and be okay, or is this a constant race between attackers and defenders? If it's the first, more pressure is great. If it's the second, it's a bit depressing to spend even more time and energy on a zero sum game.
  - aerostable_slug 5y ago
    It is a constant arms race that the defender is nearly guaranteed to lose (for a variety of reasons). This is why resilience is incredibly important. Unfortunately, too often we see M&M security — hard crunchy shell exterior, but once you're in it's delicious sweet chocolate that the business is unprepared for the attacker to start eating.
    - 3pt14159 5y ago
      Well, for many sectors it wasn't even an arms race at all. It was just getting pwnd and not caring because the attackers basically stole the data and it didn't really disrupt your business. Now with ransomware the arms race part has started, and that's a good thing because it means the bar overall is higher.
      - Zababa 5y ago
        I don't understand how it is a good thing. Doesn't that mean that more money/time/energy will be spent compared to before for the same results? If that's the case, that sounds worse to me, but maybe I missed something.
formerly_proven 5y ago
> Everything connected to a company network is having to be audited for patches and approved OS installs. IT needs to have root access to every system. Any system not approved to be networked will be isolated at the switch to knock off the network and that team's other IT systems will be knocked off too. It's not wrong to do any of this (it seems to be the norm, actually) but doing NAC kinda implies you're thinking of your intranet as some kind of perimeter to secure which is ultimately not that helpful and makes people lazy and complacent because "our service is just on the secure network, amirite?".
- orev 5y ago
  One can make an argument like this about anything, and it’s just a defeatist attitude. Why bother to do anything then? The reality is that security should be done in layers, and this is an important layer. The handwavy “and then it causes everyone to become incompetent” type of argument is really just nonsense that needs to go away.
  - legulere 5y ago
    Not necessarily. Your security model should be that any computer on your network could be infected. It’s very likely to happen and if there’s any flaw that allows infection it’s not your whole network that gets compromised.
TriNetra 5y ago
These things are part of the basic tenets [0] of the NIST's Zero Trust Architecture [1], which has become an important cybersecurity target for enterprises. 0: https://aspsecuritykit.net/blog/7-tenets-of-nist-zero-trust-architecture-zta/ https://aspsecuritykit.net/blog/7-tenets-of-nist-zero-trust-... 1: https://csrc.nist.gov/publications/detail/sp/800-207/final https://csrc.nist.gov/publications/detail/sp/800-207/final
- deleted 5y ago
  [deleted]
- blowski 5y ago
  My experience is companies treating security as if it were a competition where having more "security points" than the hacker means you can't be hacked. Which leads to bizarrely wrong trade-offs like "we don't need passwords on the prod database because it's only accessible through the private network". Even worse is "we're on AWS so we have Amazon-level security".
  - TriNetra 5y ago
    That's actually anti-ZT practice, which clearly requires that you put maximum security controls you can to protect every resource. especially do not assume trust based on network location/perimeter, is very first tenet. But yeah, security in many orgs (regardless of the size), is another item to be ticked, and thus a false sense of security prevails until an incident happens. Eventually, only such orgs will survive and thrive which will be able to defend their resources, in the increasingly hostile online environment with state-backed attackers. Whether this defense comes from individual organizations or their state, or a combination of both, that's something to be seen in the next 5 to 10 years.
antaviana 5y ago
Ramsomware has found a business model greatly thanks to cryptocurrency which has removed a lot of friction in the payment process. You do not have to leave anymore a paper bag full of cash in the park to get your files unencrypted. A healthy business model helps to attract talent into the ramsomware business, which improves the time-to-market of exploits. All this helps to increase the need for security and business continuity investments so for 2022 I anticipate healthy growth of that industry. IMHO, Bitcoin role is not really a mere store of value with built-in inflation protection. Bitcoin is also an enabler for strong growth in the information security industry.
legulere 5y ago
IT having root access to every system is how every system was infected at the company I’m currently working for. And they’re not learning from it.
_8j50 5y ago
I work in infosec doing defensive stuff. I am not worried about ransomware in the least, at least not on its own, the thing you have to understand is, when all these companies get a ransomware attack, it isn't always a resuly of the ransomware worming its way through computers. These days operators manually find lateral movement paths and get domain admin and deploy the ransomware using GPO or something. Bare minimim compliance to Microsoft tiered security model prevents most of these attacks and there is a lot you can do to prevent this. Sabotage attacks don't worry me. I hope the bad guys don't read this but what worries me is targeted intrusions where the bad guys do corporate espionage and IP theft but use ransomware as a smokescreen. 10K filings, product announcements. Heck, sit silently on the right guy's inbox and you can do your own insider trading scheme and it pays more than ransomware. To me ransomware is like holding up a bank but you only take the cash in cash registers, rob everyone in the lobby and create a commotion and down time for the bank and leave. Don't get me wrong? I think ransomware will continue to be popular, I am just not that concerned because the team i am on takes adequate measures to stop your run of the mill ransomware gang.
- suifbwish 5y ago
  Not giving admin accounts to non IT staff goes a hell of a long way
  - _8j50 5y ago
    And requiring privileged access workstations for admin account usage, preventing and alerting when admin accounts are used from anywhere else goes a long way too.

3pt14159 5y ago

Good. We're finally, FINALLY getting some pressure to fix all these broken systems. I was literally losing sleep over some of the crazy shit I saw. It's still a tire fire, but at the very least there is some movement to fix it.

mrweasel 5y ago
A lot of people don’t understand how much gruft is in IT. While I doubt it, my hope for the new year is that business will slow down and shift focus. Rather than building ever more complex system, for what ever reason, perhaps we can now focus on simpler and more secure solution. The collective memory of our industry is shockingly short. If Log4J has taught me anything it is that the old meme: “LOL; It OPSs problem now” is very much still all too real.
unethical_ban 5y ago
I'll miss the good old days where our lab environment was never looked at by security or IT. I was a firewall admin at a F100 bank and we had some linux servers we used to do automation against our production firewall systems. We did some of the best, most secure work we ever did because we had access to scripting systems and Python. We built a host of auditing, ops, and secure automation and cleanup tools. It took months if not literally a year or more to convince all the right "stakeholders" that we need a prod server for such a purpose. Same reason we used Bottle.py for our web GUI: We didn't have to install it; it ran on system Python install. I also remember standing up Dokuwiki because our company was two years away from deploying Confluence (puke), and remember setting up Gitlab in a lab environment two years before we got Gitlab, because we only had... some IBM version control, all the tooling and regs around it were built around enterprise product development, not backend. In other words, shadow IT led us to be a more secure organization. It seems IT in the 2020s is getting a clue when it comes to deployment, and now that they have automated everything from deploy to scan, it isn't such a huge ask to get a linux server with which to program. Maybe shadow IT won't be needed anymore. Then again, perfect enforcement of laws is a dangerous thing in society. Maybe too in cyber?
Zababa 5y ago
I don't know much about computer security. Is this a domain where you can fix something that was broken and be okay, or is this a constant race between attackers and defenders? If it's the first, more pressure is great. If it's the second, it's a bit depressing to spend even more time and energy on a zero sum game.
- aerostable_slug 5y ago
  It is a constant arms race that the defender is nearly guaranteed to lose (for a variety of reasons). This is why resilience is incredibly important. Unfortunately, too often we see M&M security — hard crunchy shell exterior, but once you're in it's delicious sweet chocolate that the business is unprepared for the attacker to start eating.
  - 3pt14159 5y ago
    Well, for many sectors it wasn't even an arms race at all. It was just getting pwnd and not caring because the attackers basically stole the data and it didn't really disrupt your business. Now with ransomware the arms race part has started, and that's a good thing because it means the bar overall is higher.
    - Zababa 5y ago
      I don't understand how it is a good thing. Doesn't that mean that more money/time/energy will be spent compared to before for the same results? If that's the case, that sounds worse to me, but maybe I missed something.

formerly_proven 5y ago

> Everything connected to a company network is having to be audited for patches and approved OS installs. IT needs to have root access to every system. Any system not approved to be networked will be isolated at the switch to knock off the network and that team's other IT systems will be knocked off too. It's not wrong to do any of this (it seems to be the norm, actually) but doing NAC kinda implies you're thinking of your intranet as some kind of perimeter to secure which is ultimately not that helpful and makes people lazy and complacent because "our service is just on the secure network, amirite?".

orev 5y ago
One can make an argument like this about anything, and it’s just a defeatist attitude. Why bother to do anything then? The reality is that security should be done in layers, and this is an important layer. The handwavy “and then it causes everyone to become incompetent” type of argument is really just nonsense that needs to go away.
- legulere 5y ago
  Not necessarily. Your security model should be that any computer on your network could be infected. It’s very likely to happen and if there’s any flaw that allows infection it’s not your whole network that gets compromised.

TriNetra 5y ago

These things are part of the basic tenets [0] of the NIST's Zero Trust Architecture [1], which has become an important cybersecurity target for enterprises. 0: https://aspsecuritykit.net/blog/7-tenets-of-nist-zero-trust-architecture-zta/ https://aspsecuritykit.net/blog/7-tenets-of-nist-zero-trust-... 1: https://csrc.nist.gov/publications/detail/sp/800-207/final https://csrc.nist.gov/publications/detail/sp/800-207/final

deleted 5y ago
[deleted]
blowski 5y ago
My experience is companies treating security as if it were a competition where having more "security points" than the hacker means you can't be hacked. Which leads to bizarrely wrong trade-offs like "we don't need passwords on the prod database because it's only accessible through the private network". Even worse is "we're on AWS so we have Amazon-level security".
- TriNetra 5y ago
  That's actually anti-ZT practice, which clearly requires that you put maximum security controls you can to protect every resource. especially do not assume trust based on network location/perimeter, is very first tenet. But yeah, security in many orgs (regardless of the size), is another item to be ticked, and thus a false sense of security prevails until an incident happens. Eventually, only such orgs will survive and thrive which will be able to defend their resources, in the increasingly hostile online environment with state-backed attackers. Whether this defense comes from individual organizations or their state, or a combination of both, that's something to be seen in the next 5 to 10 years.

antaviana 5y ago

Ramsomware has found a business model greatly thanks to cryptocurrency which has removed a lot of friction in the payment process. You do not have to leave anymore a paper bag full of cash in the park to get your files unencrypted. A healthy business model helps to attract talent into the ramsomware business, which improves the time-to-market of exploits. All this helps to increase the need for security and business continuity investments so for 2022 I anticipate healthy growth of that industry. IMHO, Bitcoin role is not really a mere store of value with built-in inflation protection. Bitcoin is also an enabler for strong growth in the information security industry.

legulere 5y ago

IT having root access to every system is how every system was infected at the company I’m currently working for. And they’re not learning from it.

_8j50 5y ago

I work in infosec doing defensive stuff. I am not worried about ransomware in the least, at least not on its own, the thing you have to understand is, when all these companies get a ransomware attack, it isn't always a resuly of the ransomware worming its way through computers. These days operators manually find lateral movement paths and get domain admin and deploy the ransomware using GPO or something. Bare minimim compliance to Microsoft tiered security model prevents most of these attacks and there is a lot you can do to prevent this. Sabotage attacks don't worry me. I hope the bad guys don't read this but what worries me is targeted intrusions where the bad guys do corporate espionage and IP theft but use ransomware as a smokescreen. 10K filings, product announcements. Heck, sit silently on the right guy's inbox and you can do your own insider trading scheme and it pays more than ransomware. To me ransomware is like holding up a bank but you only take the cash in cash registers, rob everyone in the lobby and create a commotion and down time for the bank and leave. Don't get me wrong? I think ransomware will continue to be popular, I am just not that concerned because the team i am on takes adequate measures to stop your run of the mill ransomware gang.

suifbwish 5y ago
Not giving admin accounts to non IT staff goes a hell of a long way
- _8j50 5y ago
  And requiring privileged access workstations for admin account usage, preventing and alerting when admin accounts are used from anywhere else goes a long way too.