6 ms·

It's heartening to see a government do something that is technologically progressive and useful. I would rather hope that EU/Anglosphere/Japan/Korea etc. 'team

by jasmer 4y ago

It's heartening to see a government do something that is technologically progressive and useful. I would rather hope that EU/Anglosphere/Japan/Korea etc. 'team up' on this one and at minimum exchange notes and best practices.

tsujamin 4y ago
The Australian counterpart to NCSC does similar with its CHIPs program (https://www.cyber.gov.au/acsc/view-all-content/news/acscncsc-collaboration-strengthen-cyber-security-posture https://www.cyber.gov.au/acsc/view-all-content/news/acscncsc...)
- tmn007 4y ago
  That is just government though. However I'm sure ACSC is scanning all known AU websites...
astonex 4y ago
Korea and Japan are far far behind when it comes to government agencies and their tech competency.
jollofricepeas 4y ago
Sorry. Im going to say this isn’t technologically useful. REASONS: 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. 2. Most attacks lead with phishing and account takeovers not software vulns. Most people assume that if you scan all the things it fixes the problem or even empowers people to fix problems but it doesn’t. If governments want to do something truly progressive then here’s a better option. 1. Use MFA preferably hardware tokens everywhere. 2. Catalog all externally exposed assets 3. Catalog all high-risk internal assets 4. Regularly white box pentest your assets (switch vendors annually) and implement a bug bounty program as well 5. Penalize any organization that doesn’t remediate their critical pentest and bug bounty findings
- zinekeller 4y ago
  > 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. EQUIFAAAAAAAAAAAAAX!!!!!!!!! (Yes, the Equifax hack was due to a widely-known vulnerability in Apache Commons that apparently the DHS warned about but Equifax didn't bother to patch it.) Also, knowing that hospital equipment still runs Windows XP (with some sturdy-but-aged machines running Windows 2000), I'm not sure if there's any good benefit for this. Sure, small businesses might take action on a genuine oversight but larger businesses tend to know already that their systems are insecure (even when taking state-level/sponsored attack out of the equation).
  - hulitu 4y ago
    > Also, knowing that hospital equipment still runs Windows XP You don't need to connect your MRI scanner to the internet.
- iwasanewt 4y ago
  > this isn’t technologically useful. > REASONS: > 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. This reason only makes sense to me if I assume that all KNOWN vulnerabilities are (and remain) UNFIXED. Assuming otherwise doesn't make sense because I can't tell how many attacks the KNOWN and FIXED vulnerabilities prevented. > Most attacks lead with phishing and account takeovers not software vulns. This might be true, but you seem to suggest that we can only concentrate on preventing one type of attack at a time, and therefore we should only pick defensive strategies for the most common attack,
  - jollofricepeas 4y ago
    To clarify, I’m saying governments and regulatory bodies should improve mandates for fixing critical issues with the highest risk first (ie. Remediation). It’s the same reason state govs in the US mandate car insurance or bonds for drivers. Companies like people have limited resources, time and money so they should focus on where the risk lies. Risk being impact multiplied by likelihood. If you have to choose, which do you do first? - Bump your library versions for all your apps - Implement MFA for your customers

by jasmer 4y ago

tsujamin 4y ago

The Australian counterpart to NCSC does similar with its CHIPs program (https://www.cyber.gov.au/acsc/view-all-content/news/acscncsc-collaboration-strengthen-cyber-security-posture https://www.cyber.gov.au/acsc/view-all-content/news/acscncsc...)

tmn007 4y ago
That is just government though. However I'm sure ACSC is scanning all known AU websites...

astonex 4y ago

Korea and Japan are far far behind when it comes to government agencies and their tech competency.

jollofricepeas 4y ago

Sorry. Im going to say this isn’t technologically useful. REASONS: 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. 2. Most attacks lead with phishing and account takeovers not software vulns. Most people assume that if you scan all the things it fixes the problem or even empowers people to fix problems but it doesn’t. If governments want to do something truly progressive then here’s a better option. 1. Use MFA preferably hardware tokens everywhere. 2. Catalog all externally exposed assets 3. Catalog all high-risk internal assets 4. Regularly white box pentest your assets (switch vendors annually) and implement a bug bounty program as well 5. Penalize any organization that doesn’t remediate their critical pentest and bug bounty findings

zinekeller 4y ago
> 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. EQUIFAAAAAAAAAAAAAX!!!!!!!!! (Yes, the Equifax hack was due to a widely-known vulnerability in Apache Commons that apparently the DHS warned about but Equifax didn't bother to patch it.) Also, knowing that hospital equipment still runs Windows XP (with some sturdy-but-aged machines running Windows 2000), I'm not sure if there's any good benefit for this. Sure, small businesses might take action on a genuine oversight but larger businesses tend to know already that their systems are insecure (even when taking state-level/sponsored attack out of the equation).
- hulitu 4y ago
  > Also, knowing that hospital equipment still runs Windows XP You don't need to connect your MRI scanner to the internet.
iwasanewt 4y ago
> this isn’t technologically useful. > REASONS: > 1. Over 80% of breaches happen because of KNOWN but unfixed vulnerabilities. This reason only makes sense to me if I assume that all KNOWN vulnerabilities are (and remain) UNFIXED. Assuming otherwise doesn't make sense because I can't tell how many attacks the KNOWN and FIXED vulnerabilities prevented. > Most attacks lead with phishing and account takeovers not software vulns. This might be true, but you seem to suggest that we can only concentrate on preventing one type of attack at a time, and therefore we should only pick defensive strategies for the most common attack,
- jollofricepeas 4y ago
  To clarify, I’m saying governments and regulatory bodies should improve mandates for fixing critical issues with the highest risk first (ie. Remediation). It’s the same reason state govs in the US mandate car insurance or bonds for drivers. Companies like people have limited resources, time and money so they should focus on where the risk lies. Risk being impact multiplied by likelihood. If you have to choose, which do you do first? - Bump your library versions for all your apps - Implement MFA for your customers