5 ms·

> The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad a

> The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.

etothepii 5y ago
That feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.
- ianai 5y ago
  Do you have a suggestion for a change to treating network security?
  - more_corn 5y ago
    1) 802.1x certificate based network security (The MDM configures each approved network device with a certificate so rogue devices can't get on the network) 2) Periodic security review (look at attached network devices and determine an owner and purpose for each one). 3) Configure SIEM to alert on long-lived outbound connections.
    - ianai 5y ago
      Can that (1) be done with windows/Mac clients?
      - ianai 5y ago
        Answering myself: yes, is industry standard, definitely a little odd to not have it configured on a corporate network past a handful of employees.
        jaywalk 5y ago
        There's a decent amount of infrastructure involved in getting 802.1x authentication up and running in an efficient manner. While it does provide very good security, it's not widely used because of that.
        ianai 5y ago
        Any idea on a good, at-home or small network alternative?
        nitrogen 5y ago
        Having a list of allowed MAC addresses, enforced per-port by a managed switch (or at least by the DHCP server and router), is a first step, though naturally it's easy to spoof a MAC address.
        jaywalk 5y ago
        MAC address filtering isn't a first step towards 802.1x, precisely because of the reason you mentioned. It's damn near pointless for all but the most basic security scenarios.
        nitrogen 5y ago
        Obviously it's not a first step toward certificates, but it is a first step away from "anyone can casually plug in a hidden Pi."
        genera1 5y ago
        Anyone who knows how to setup that RPi to do anything meaningful knows how to spoof mac
  - etothepii 5y ago
    Treat every computer like it's connected to the internet. Probably by actually connecting it to the internet. Since the idea that you can keep people out of your network is probably more dangerous in the long term.
    - bigiain 5y ago
      Yep. Anything that can connect _out_ to the internet can be misused to connect _in from_ the internet. All it takes is a human or technology flaw on the inside to "breach" your outbound connections only security policy. As a whole bunch of unwitting Log4J users recently found out. Reverse SSH Tunnels aren't all that different from Remote Access Trojans.

etothepii 5y ago

That feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.

ianai 5y ago
Do you have a suggestion for a change to treating network security?
- more_corn 5y ago
  1) 802.1x certificate based network security (The MDM configures each approved network device with a certificate so rogue devices can't get on the network) 2) Periodic security review (look at attached network devices and determine an owner and purpose for each one). 3) Configure SIEM to alert on long-lived outbound connections.
  - ianai 5y ago
    Can that (1) be done with windows/Mac clients?
    - ianai 5y ago
      Answering myself: yes, is industry standard, definitely a little odd to not have it configured on a corporate network past a handful of employees.
      - jaywalk 5y ago
        There's a decent amount of infrastructure involved in getting 802.1x authentication up and running in an efficient manner. While it does provide very good security, it's not widely used because of that.
        ianai 5y ago
        Any idea on a good, at-home or small network alternative?
        nitrogen 5y ago
        Having a list of allowed MAC addresses, enforced per-port by a managed switch (or at least by the DHCP server and router), is a first step, though naturally it's easy to spoof a MAC address.
        jaywalk 5y ago
        MAC address filtering isn't a first step towards 802.1x, precisely because of the reason you mentioned. It's damn near pointless for all but the most basic security scenarios.
        nitrogen 5y ago
        Obviously it's not a first step toward certificates, but it is a first step away from "anyone can casually plug in a hidden Pi."
        genera1 5y ago
        Anyone who knows how to setup that RPi to do anything meaningful knows how to spoof mac
- etothepii 5y ago
  Treat every computer like it's connected to the internet. Probably by actually connecting it to the internet. Since the idea that you can keep people out of your network is probably more dangerous in the long term.
  - bigiain 5y ago
    Yep. Anything that can connect _out_ to the internet can be misused to connect _in from_ the internet. All it takes is a human or technology flaw on the inside to "breach" your outbound connections only security policy. As a whole bunch of unwitting Log4J users recently found out. Reverse SSH Tunnels aren't all that different from Remote Access Trojans.