5 ms·

Good. We're finally, FINALLY getting some pressure to fix all these broken systems. I was literally losing sleep over some of the crazy shit I saw. It's still a

Good. We're finally, FINALLY getting some pressure to fix all these broken systems. I was literally losing sleep over some of the crazy shit I saw. It's still a tire fire, but at the very least there is some movement to fix it.

mrweasel 5y ago
A lot of people don’t understand how much gruft is in IT. While I doubt it, my hope for the new year is that business will slow down and shift focus. Rather than building ever more complex system, for what ever reason, perhaps we can now focus on simpler and more secure solution. The collective memory of our industry is shockingly short. If Log4J has taught me anything it is that the old meme: “LOL; It OPSs problem now” is very much still all too real.
unethical_ban 5y ago
I'll miss the good old days where our lab environment was never looked at by security or IT. I was a firewall admin at a F100 bank and we had some linux servers we used to do automation against our production firewall systems. We did some of the best, most secure work we ever did because we had access to scripting systems and Python. We built a host of auditing, ops, and secure automation and cleanup tools. It took months if not literally a year or more to convince all the right "stakeholders" that we need a prod server for such a purpose. Same reason we used Bottle.py for our web GUI: We didn't have to install it; it ran on system Python install. I also remember standing up Dokuwiki because our company was two years away from deploying Confluence (puke), and remember setting up Gitlab in a lab environment two years before we got Gitlab, because we only had... some IBM version control, all the tooling and regs around it were built around enterprise product development, not backend. In other words, shadow IT led us to be a more secure organization. It seems IT in the 2020s is getting a clue when it comes to deployment, and now that they have automated everything from deploy to scan, it isn't such a huge ask to get a linux server with which to program. Maybe shadow IT won't be needed anymore. Then again, perfect enforcement of laws is a dangerous thing in society. Maybe too in cyber?
Zababa 5y ago
I don't know much about computer security. Is this a domain where you can fix something that was broken and be okay, or is this a constant race between attackers and defenders? If it's the first, more pressure is great. If it's the second, it's a bit depressing to spend even more time and energy on a zero sum game.
- aerostable_slug 5y ago
  It is a constant arms race that the defender is nearly guaranteed to lose (for a variety of reasons). This is why resilience is incredibly important. Unfortunately, too often we see M&M security — hard crunchy shell exterior, but once you're in it's delicious sweet chocolate that the business is unprepared for the attacker to start eating.
  - 3pt14159 5y ago
    Well, for many sectors it wasn't even an arms race at all. It was just getting pwnd and not caring because the attackers basically stole the data and it didn't really disrupt your business. Now with ransomware the arms race part has started, and that's a good thing because it means the bar overall is higher.
    - Zababa 5y ago
      I don't understand how it is a good thing. Doesn't that mean that more money/time/energy will be spent compared to before for the same results? If that's the case, that sounds worse to me, but maybe I missed something.

mrweasel 5y ago

A lot of people don’t understand how much gruft is in IT. While I doubt it, my hope for the new year is that business will slow down and shift focus. Rather than building ever more complex system, for what ever reason, perhaps we can now focus on simpler and more secure solution. The collective memory of our industry is shockingly short. If Log4J has taught me anything it is that the old meme: “LOL; It OPSs problem now” is very much still all too real.

unethical_ban 5y ago

I'll miss the good old days where our lab environment was never looked at by security or IT. I was a firewall admin at a F100 bank and we had some linux servers we used to do automation against our production firewall systems. We did some of the best, most secure work we ever did because we had access to scripting systems and Python. We built a host of auditing, ops, and secure automation and cleanup tools. It took months if not literally a year or more to convince all the right "stakeholders" that we need a prod server for such a purpose. Same reason we used Bottle.py for our web GUI: We didn't have to install it; it ran on system Python install. I also remember standing up Dokuwiki because our company was two years away from deploying Confluence (puke), and remember setting up Gitlab in a lab environment two years before we got Gitlab, because we only had... some IBM version control, all the tooling and regs around it were built around enterprise product development, not backend. In other words, shadow IT led us to be a more secure organization. It seems IT in the 2020s is getting a clue when it comes to deployment, and now that they have automated everything from deploy to scan, it isn't such a huge ask to get a linux server with which to program. Maybe shadow IT won't be needed anymore. Then again, perfect enforcement of laws is a dangerous thing in society. Maybe too in cyber?

Zababa 5y ago

I don't know much about computer security. Is this a domain where you can fix something that was broken and be okay, or is this a constant race between attackers and defenders? If it's the first, more pressure is great. If it's the second, it's a bit depressing to spend even more time and energy on a zero sum game.

aerostable_slug 5y ago
It is a constant arms race that the defender is nearly guaranteed to lose (for a variety of reasons). This is why resilience is incredibly important. Unfortunately, too often we see M&M security — hard crunchy shell exterior, but once you're in it's delicious sweet chocolate that the business is unprepared for the attacker to start eating.
- 3pt14159 5y ago
  Well, for many sectors it wasn't even an arms race at all. It was just getting pwnd and not caring because the attackers basically stole the data and it didn't really disrupt your business. Now with ransomware the arms race part has started, and that's a good thing because it means the bar overall is higher.
  - Zababa 5y ago
    I don't understand how it is a good thing. Doesn't that mean that more money/time/energy will be spent compared to before for the same results? If that's the case, that sounds worse to me, but maybe I missed something.