3 ms·
99% of the time, no. But you only need one person to be absent minded (perhaps tired, maybe stressed and multitasking, maybe receiving constant interruptions fr
by hnlmorg 3y ago
99% of the time, no. But you only need one person to be absent minded (perhaps tired, maybe stressed and multitasking, maybe receiving constant interruptions from kids or work colleagues, etc).
There was some story I read years ago about how terrorists (I think it was) could have their plot foiled 99% of the time but they only needed to be successful once. Whereas their targets need to be successful 100% of the time. (I wish I could remember where I heard that)…anyways, this applies to IT security too.
- Eisenstein 3y ago> (I wish I could remember where I heard that) You probably heard it from multiple sources since it is a cliche used in all types of security fields. Kind of like how 'if you are getting something of value for free you are the product not the client' is for web-services people.
- hnlmorg 3y agoTrue. I’ve definitely heard it a few times. But there is one particular occasion that really stuck out at me. The way it was phrased, the specific domain, it was really poignant. I think because it was about terrorists and people losing lives, it brought a more tangible, human, cost to the equation.
- NegativeK 3y ago> this applies to IT security too. This is true, but an IT security team also has a huge number of opportunities to detect an intruder. If the defender has just one security vulnerability, the intruder can get in -- and the defender typically won't know about the security vulnerability ahead of time. If the intruder is noisy just once, the defender can catch them -- and the intruder typically won't know what's being listened to or even what systems/credentials are real.
- hnlmorg 3y agoDetection is important but by that point damage has already been done. Detection will just allow you to scope out the scale of the damage. It’s also worth noting that we are talking about contractors laptops here. So they wouldn’t be subject to management by IT security teams. At best, they’re entirely disconnected from the IT systems that contractor is hired to work on. It at worse, they’re used as a BYOD. And the worst case is surprisingly often the norm.
- lolinder 3y agoThe point is that the consequences for failure are lower for the attacker than for the defender. In the case of the attempted assassination of Margaret Thatcher, the bomb failed to kill Thatcher, but the IRA could always try again. Only one bomb needed to succeed, and even if they lost some operatives they could keep going until Thatcher was dead. The case in information security is even worse, because most attackers are completely out of reach for retaliation. They're extremely difficult to track down, and even when you do it's usually to a country that won't even consider extradition. So they can try again and again, and you have to catch them every time or they'll achieve their goal.
- sowbug 3y agoIt's toward the end of season one of Narcos, but the subjects are cops and criminals.
- janstice 3y agoOddly enough, the quote is from a legitamate terrorist organisation following a bomb attack on a UK political conference, that wasn't that far off killing the PM at the time (and killed 5 others). The IRA statement following the bombing was: "Thatcher will now realise that Britain cannot occupy our country and torture our prisoners and shoot our people in their own streets and get away with it. Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always. Give Ireland peace and there will be no more war."
- hnlmorg 3y agoYes! That was exactly the source I was thinking of. Thank you