5 ms·

Never ceases to amaze me. I know upgrading servers can be royally difficult but for something as large and critical as NASDAQ and the fact that security expert

Never ceases to amaze me. I know upgrading servers can be royally difficult but for something as large and critical as NASDAQ and the fact that security experts seem to suggest that keeping software up to date is the #1 important rule, you would have thought that updating servers would be part of their general security strategy.

nobody314159265 15y ago
Did those security experts suggest that the new patches would have any less holes than the current ones? Meanwhile all the other experts suggest not touching a high performance, high throughput system by immediately installing every new patch that arrives.
- briandear 15y ago
  Does 'immediately' = 'within a few years'?
tptacek 15y ago
I'm guessing what would really amaze you is the scale of an IT operation like NASDAQ, the velocity of day-to-day changes that need to be kept up with, and the extreme difficulty of staffing a competent security team to handle it. I take your point --- if you're ostensibly made of money (NASDAQ is more or less a "tier 1 ISP for money"), you should just be able to spend more money to address this problem. However, as important as security has become in the last several years, the strategic scale of the problem really hasn't sunk in at the highest levels of most companies. Operations and development are still adversarial to security, they still run the table, and all three of these groups (ops, dev, and security) are still considered cost centers by COOs.
- wanorris 15y ago
  They're considered cost centers, because they are cost centers. Unless you generate revenue by selling software or providing operational or security services to others, there is no direct sales upside to spending more money in these areas. There is only downside risk to not spending enough and screwing something up -- that makes them cost centers, not profit centers. That doesn't mean they're not important, of course. Any cost center that didn't perform an important function would just be cut. But it's just like running payroll -- it would be disastrous if you couldn't do it in a consistent and timely fashion, but as long as everything seems to be working correctly, nobody outside that area is ever going to care that much about it.
  - tptacek 15y ago
    You're right, but the connotation to "IT cost center" is, "thing to be cut to smallest footprint possible".
  - ldar15 15y ago
    Not at all. They are only cost centers because that's how business guys divided them up to get they toys they wanted. Consider the following two divisions: 1. Revenue center model Currently we have no computers. If we build a system that securely allows financial transactions, we can make a lot of revenue. We will assemble a team that builds a secure system for financial transactions. 2. Cost Center model We will build a system that handles financial transactions. That will be our revenue center. The system will not have security as a requirement. Then we will have a cost center that is responsible for making this system secure. PHB: Which costs more? Option 1? Ok, do option 2 then. Build me a system that isn't secure first, and then we'll work on that when we can.
    - mkopinsky 15y ago
      Agreed. Baking security in to your products in the first place is the only way to do it.

nobody314159265 15y ago

Did those security experts suggest that the new patches would have any less holes than the current ones? Meanwhile all the other experts suggest not touching a high performance, high throughput system by immediately installing every new patch that arrives.

briandear 15y ago
Does 'immediately' = 'within a few years'?

tptacek 15y ago

I'm guessing what would really amaze you is the scale of an IT operation like NASDAQ, the velocity of day-to-day changes that need to be kept up with, and the extreme difficulty of staffing a competent security team to handle it. I take your point --- if you're ostensibly made of money (NASDAQ is more or less a "tier 1 ISP for money"), you should just be able to spend more money to address this problem. However, as important as security has become in the last several years, the strategic scale of the problem really hasn't sunk in at the highest levels of most companies. Operations and development are still adversarial to security, they still run the table, and all three of these groups (ops, dev, and security) are still considered cost centers by COOs.

wanorris 15y ago
They're considered cost centers, because they are cost centers. Unless you generate revenue by selling software or providing operational or security services to others, there is no direct sales upside to spending more money in these areas. There is only downside risk to not spending enough and screwing something up -- that makes them cost centers, not profit centers. That doesn't mean they're not important, of course. Any cost center that didn't perform an important function would just be cut. But it's just like running payroll -- it would be disastrous if you couldn't do it in a consistent and timely fashion, but as long as everything seems to be working correctly, nobody outside that area is ever going to care that much about it.
- tptacek 15y ago
  You're right, but the connotation to "IT cost center" is, "thing to be cut to smallest footprint possible".
- ldar15 15y ago
  Not at all. They are only cost centers because that's how business guys divided them up to get they toys they wanted. Consider the following two divisions: 1. Revenue center model Currently we have no computers. If we build a system that securely allows financial transactions, we can make a lot of revenue. We will assemble a team that builds a secure system for financial transactions. 2. Cost Center model We will build a system that handles financial transactions. That will be our revenue center. The system will not have security as a requirement. Then we will have a cost center that is responsible for making this system secure. PHB: Which costs more? Option 1? Ok, do option 2 then. Build me a system that isn't secure first, and then we'll work on that when we can.
  - mkopinsky 15y ago
    Agreed. Baking security in to your products in the first place is the only way to do it.