6 ms·
The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad act
by etothepii 5y ago
The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better.
There is a systematic issue at the heart of the way we do network security.
You can by a lighting / usb cable that can do all of these things and more for $120 if he'd used that he'd never have gotten caught.
We treat network security like physical security at our peril.
- Ensorceled 5y ago> The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.
- etothepii 5y agoThat feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.
- ianai 5y agoDo you have a suggestion for a change to treating network security?
- more_corn 5y ago1) 802.1x certificate based network security (The MDM configures each approved network device with a certificate so rogue devices can't get on the network) 2) Periodic security review (look at attached network devices and determine an owner and purpose for each one). 3) Configure SIEM to alert on long-lived outbound connections.
- ianai 5y agoCan that (1) be done with windows/Mac clients?
- ianai 5y agoAnswering myself: yes, is industry standard, definitely a little odd to not have it configured on a corporate network past a handful of employees.
- jaywalk 5y agoThere's a decent amount of infrastructure involved in getting 802.1x authentication up and running in an efficient manner. While it does provide very good security, it's not widely used because of that.
- ianai 5y agoAny idea on a good, at-home or small network alternative?
- nitrogen 5y agoHaving a list of allowed MAC addresses, enforced per-port by a managed switch (or at least by the DHCP server and router), is a first step, though naturally it's easy to spoof a MAC address.
- jaywalk 5y agoMAC address filtering isn't a first step towards 802.1x, precisely because of the reason you mentioned. It's damn near pointless for all but the most basic security scenarios.
- nitrogen 5y agoObviously it's not a first step toward certificates, but it is a first step away from "anyone can casually plug in a hidden Pi."
- etothepii 5y agoTreat every computer like it's connected to the internet. Probably by actually connecting it to the internet. Since the idea that you can keep people out of your network is probably more dangerous in the long term.
- bigiain 5y agoYep. Anything that can connect _out_ to the internet can be misused to connect _in from_ the internet. All it takes is a human or technology flaw on the inside to "breach" your outbound connections only security policy. As a whole bunch of unwitting Log4J users recently found out. Reverse SSH Tunnels aren't all that different from Remote Access Trojans.
- eternityforest 5y agoWithout changing things so radically that we might not even be able to continue having a "Do everything in software with one click" society, social deterrence is going to to be important. Unless people are manually verifying GPG keys in person all the time, you're gonna need to trust someone. Even with a two man rule you need some degree of trust. Trust is easier when people know they might go to jail if they break it.