5 ms·

CircleCI have sufficient logging, however, failed to do fraud analysis to detect irregular access. Fraud analysis can be basic and just have a threshold on the

CircleCI have sufficient logging, however, failed to do fraud analysis to detect irregular access. Fraud analysis can be basic and just have a threshold on the number of encryption keys accessed each day. For this particular employee, there will have been a spike. They also point their finger at anti-virus for not detecting the malware. That is a lame excuses. Professional malware developers will check if their product goes undetected by the major anti-virus providers. Anti-virus should not be relied upon to protect against sophisticated attacks

maccard 4y ago
They didn't blame the anti malware. In the blog post[0] all they say is > This machine was compromised on December 16, 2022. The malware was not detected by our antivirus software That's not blaming that's telling people that their antivirus didn't detect it. If that wasn't there, people would be talking about why they didn't use X antivirus which would probably detect it. > CircleCI have sufficient logging, however, failed to do fraud analysis to detect irregular access. This is a significant move of the goalposts. Of course CircleCI messed up, but to go back to the OP's point of "nobody should have that much access to production", well that's just not true. [0] https://circleci.com/blog/jan-4-2023-incident-report/ https://circleci.com/blog/jan-4-2023-incident-report/
- oxfordmale 4y ago
  I can't judge if their employees need that much access to production. However, if they need this, you need a detection mechanism. It doesn't have to be advanced; a threshold on the number of production keys accessed per day is sufficient. It should raise the alarm to the manager in question, who can then confirm if this is expected behaviour given the tasks assigned to the employee in question.
  - maccard 4y ago
    Again I'm not saying circle CI didn't mess up, but that's orthogonal to whether or not someone has access to customer data.
    - oxfordmale 4y ago
      Not necessarily. AWS engineers cannot access your encryption keys unless you give them explicit permissions. They even offer Nitro enclaves where AWS Engineers can never access your keys. Giving access to customer data to your staff by default is a design decision and can be avoided. However, in the end, it is a cost-benefit analysis where you have to decide how much you care about your customer's security. I have worked for enough start-ups/growth companies to know the value put on customers' security is sometimes shockingly low.
iLoveOncall 4y ago
Not just professional malware developers. Any script kiddie can pay 10 bucks to make their virus undetectable. This is why Antiviruses are totally useless, they're incredibly easy to bypass.
- charcircuit 4y ago
  >This is why Antiviruses are totally useless Not all attacks are targeted and AV can detect abnormal behaviour. Regardless, having the operating system do proper sandboxing is much more valuable than trying to fix it after the fact with AV.
- deleted 4y ago
  [deleted]

maccard 4y ago

They didn't blame the anti malware. In the blog post[0] all they say is > This machine was compromised on December 16, 2022. The malware was not detected by our antivirus software That's not blaming that's telling people that their antivirus didn't detect it. If that wasn't there, people would be talking about why they didn't use X antivirus which would probably detect it. > CircleCI have sufficient logging, however, failed to do fraud analysis to detect irregular access. This is a significant move of the goalposts. Of course CircleCI messed up, but to go back to the OP's point of "nobody should have that much access to production", well that's just not true. [0] https://circleci.com/blog/jan-4-2023-incident-report/ https://circleci.com/blog/jan-4-2023-incident-report/

oxfordmale 4y ago
I can't judge if their employees need that much access to production. However, if they need this, you need a detection mechanism. It doesn't have to be advanced; a threshold on the number of production keys accessed per day is sufficient. It should raise the alarm to the manager in question, who can then confirm if this is expected behaviour given the tasks assigned to the employee in question.
- maccard 4y ago
  Again I'm not saying circle CI didn't mess up, but that's orthogonal to whether or not someone has access to customer data.
  - oxfordmale 4y ago
    Not necessarily. AWS engineers cannot access your encryption keys unless you give them explicit permissions. They even offer Nitro enclaves where AWS Engineers can never access your keys. Giving access to customer data to your staff by default is a design decision and can be avoided. However, in the end, it is a cost-benefit analysis where you have to decide how much you care about your customer's security. I have worked for enough start-ups/growth companies to know the value put on customers' security is sometimes shockingly low.

iLoveOncall 4y ago

Not just professional malware developers. Any script kiddie can pay 10 bucks to make their virus undetectable. This is why Antiviruses are totally useless, they're incredibly easy to bypass.

charcircuit 4y ago
>This is why Antiviruses are totally useless Not all attacks are targeted and AV can detect abnormal behaviour. Regardless, having the operating system do proper sandboxing is much more valuable than trying to fix it after the fact with AV.
deleted 4y ago
[deleted]