4 ms·

I run infrastructure for a company that provides medical records services to medical organizations located exclusively in the US and have to deal with the usual

I run infrastructure for a company that provides medical records services to medical organizations located exclusively in the US and have to deal with the usual scans/exploit attempts that come with running services on the public internet. Somedays I think it's just bonkers that anyone in China or Russia or wherever is allowed to contact my servers. I know that the internet is a "network of networks" to use an older term, and I don't really see an alternative, but it still strikes me some days.

bediger4000 4y ago
Not just China and Russia, though. Lots of weirdness from Turkey, Viet Nam and even Netherlands.
- hotpotamus 4y ago
  Well I added "wherever" as a catchall - public is pretty much public. And there's a chain issue - if you ban country A, but not country B, and A is allowed to connect to B, then A can still find a path through to you - it's all just one network with a near infinite number of paths.
- refurb 4y ago
  I spent some time in Vietnam and it’s amazing how often website just block you outright (i believe US BLS is unreachable) or you’re flagged immediately as high risk (understandably since VN rarely prosecuted computer crime that originates there). Visit the same website from 100km away in Singapore and it’s like your in the US.
- mistrial9 4y ago
  banning and blocking is easy; building bridges is hard. It is documented in modern times that the first to leave a war zone are the teachers and the civilian medical people -- they can't function as they must in a world built with passkeys, barbed wire and bulk control rules. The PP here has a commercial medical system, so of course the first consideration is protecting --money-- privacy of --insurance records-- patients. Go ahead and block the world for the medical insurance, it is a block already by its nature. The question now is, will any civilian communication survive the battles of nations and currencies.
  - bediger4000 4y ago
    So you're saying that the USA's adversarial legal system makes bans and blocks the easiest/most probable way of dealing, but the consequences of that are far reaching, and yet to be noticed.
robryk 4y ago
If all your endpoints are at least somewhat under your control (i.e. the thing doesn't need to be accessible via a web browser on a vanilla computer) you can reduce "exploits" to "exploits of my implementation of TLS/my VPN of choice" plus the bootstrap issue. If the endpoints are not under your control to that extent, then I'd argue that "all the residential ISPs in US" is just as bad as "all of China/Russia" due to botnets.
- hotpotamus 4y ago
  I'm not sure what you mean by implementation of TLS. It's just standard Java TLS libraries, though of course we can be pretty strict about which ciphers are in use - we do control the client to that extent and are typically pretty good about keeping on top of that at least.
  - robryk 4y ago
    If you require client certificates then you don't need to worry about non-insider attacks on anything other than your TLS library and your client cert bootstrap procedure.
    - hotpotamus 4y ago
      I didn't even think of that as a possibility, but it's a good suggestion and something that's within the realm of feasible (though far from trivial) for us. Thank you.
      - robryk 4y ago
        TBF putting a reverse proxy that does authn and rejects requests that do not authn correctly in front of everything (except for the login pages) is nearly as good: the exposed area is then login page, reverse proxy, and the authn login in the reverse proxy. That might be vastly simpler to implement.
bombcar 4y ago
If you host your own network, you can work with your network provider to blackhole basically everything except your known clients. You'd have to record IP ranges and other things, but you could do it. Or you can ask them to blackhole the rest of the world and add exceptions if necessary.
duxup 4y ago
It's not uncommon to block those nations (and others) if there's no reason to serve them. When I was last in the networking world it was very common for companies to do so. It blocks more malicious traffic than you might expect. I would have assumed that bad actors in those nations wouldn't be scanning FROM them as much but that's not the case. I suppose anyone blocking them is just off their list of targets as they're not being low hanging fruit. For some companies it is like flipping off a light switch, malicious traffic goes from 100 to near 0 immediately. I don't like the idea of doing it, but as an admin seeing that effect and having limited resources, you do it.
xfer 4y ago
It's not hard to do this if you collaborate with your upstream or run your network, you have to ban all datacenter/hosting companies networks as well. Then your users complain they can't access your service because their vpn is using these networks...
Melatonic 4y ago
Why do you not just block everything outside of the US?
- hotpotamus 4y ago
  Well, I don't really know how to is a reason, but I suppose a surmountable one. The other thing is that I can't guarantee that all my customers' don't employ people outside the US.

bediger4000 4y ago

Not just China and Russia, though. Lots of weirdness from Turkey, Viet Nam and even Netherlands.

hotpotamus 4y ago
Well I added "wherever" as a catchall - public is pretty much public. And there's a chain issue - if you ban country A, but not country B, and A is allowed to connect to B, then A can still find a path through to you - it's all just one network with a near infinite number of paths.
refurb 4y ago
I spent some time in Vietnam and it’s amazing how often website just block you outright (i believe US BLS is unreachable) or you’re flagged immediately as high risk (understandably since VN rarely prosecuted computer crime that originates there). Visit the same website from 100km away in Singapore and it’s like your in the US.
mistrial9 4y ago
banning and blocking is easy; building bridges is hard. It is documented in modern times that the first to leave a war zone are the teachers and the civilian medical people -- they can't function as they must in a world built with passkeys, barbed wire and bulk control rules. The PP here has a commercial medical system, so of course the first consideration is protecting --money-- privacy of --insurance records-- patients. Go ahead and block the world for the medical insurance, it is a block already by its nature. The question now is, will any civilian communication survive the battles of nations and currencies.
- bediger4000 4y ago
  So you're saying that the USA's adversarial legal system makes bans and blocks the easiest/most probable way of dealing, but the consequences of that are far reaching, and yet to be noticed.

robryk 4y ago

If all your endpoints are at least somewhat under your control (i.e. the thing doesn't need to be accessible via a web browser on a vanilla computer) you can reduce "exploits" to "exploits of my implementation of TLS/my VPN of choice" plus the bootstrap issue. If the endpoints are not under your control to that extent, then I'd argue that "all the residential ISPs in US" is just as bad as "all of China/Russia" due to botnets.

hotpotamus 4y ago
I'm not sure what you mean by implementation of TLS. It's just standard Java TLS libraries, though of course we can be pretty strict about which ciphers are in use - we do control the client to that extent and are typically pretty good about keeping on top of that at least.
- robryk 4y ago
  If you require client certificates then you don't need to worry about non-insider attacks on anything other than your TLS library and your client cert bootstrap procedure.
  - hotpotamus 4y ago
    I didn't even think of that as a possibility, but it's a good suggestion and something that's within the realm of feasible (though far from trivial) for us. Thank you.
    - robryk 4y ago
      TBF putting a reverse proxy that does authn and rejects requests that do not authn correctly in front of everything (except for the login pages) is nearly as good: the exposed area is then login page, reverse proxy, and the authn login in the reverse proxy. That might be vastly simpler to implement.

bombcar 4y ago

If you host your own network, you can work with your network provider to blackhole basically everything except your known clients. You'd have to record IP ranges and other things, but you could do it. Or you can ask them to blackhole the rest of the world and add exceptions if necessary.

duxup 4y ago

It's not uncommon to block those nations (and others) if there's no reason to serve them. When I was last in the networking world it was very common for companies to do so. It blocks more malicious traffic than you might expect. I would have assumed that bad actors in those nations wouldn't be scanning FROM them as much but that's not the case. I suppose anyone blocking them is just off their list of targets as they're not being low hanging fruit. For some companies it is like flipping off a light switch, malicious traffic goes from 100 to near 0 immediately. I don't like the idea of doing it, but as an admin seeing that effect and having limited resources, you do it.

xfer 4y ago

It's not hard to do this if you collaborate with your upstream or run your network, you have to ban all datacenter/hosting companies networks as well. Then your users complain they can't access your service because their vpn is using these networks...

Melatonic 4y ago

Why do you not just block everything outside of the US?

hotpotamus 4y ago
Well, I don't really know how to is a reason, but I suppose a surmountable one. The other thing is that I can't guarantee that all my customers' don't employ people outside the US.