6 ms·
> this applies to IT security too. This is true, but an IT security team also has a huge number of opportunities to detect an intruder. If the defender has ju
by NegativeK 3y ago
> this applies to IT security too.
This is true, but an IT security team also has a huge number of opportunities to detect an intruder.
If the defender has just one security vulnerability, the intruder can get in -- and the defender typically won't know about the security vulnerability ahead of time.
If the intruder is noisy just once, the defender can catch them -- and the intruder typically won't know what's being listened to or even what systems/credentials are real.
- hnlmorg 3y agoDetection is important but by that point damage has already been done. Detection will just allow you to scope out the scale of the damage. It’s also worth noting that we are talking about contractors laptops here. So they wouldn’t be subject to management by IT security teams. At best, they’re entirely disconnected from the IT systems that contractor is hired to work on. It at worse, they’re used as a BYOD. And the worst case is surprisingly often the norm.
- lolinder 3y agoThe point is that the consequences for failure are lower for the attacker than for the defender. In the case of the attempted assassination of Margaret Thatcher, the bomb failed to kill Thatcher, but the IRA could always try again. Only one bomb needed to succeed, and even if they lost some operatives they could keep going until Thatcher was dead. The case in information security is even worse, because most attackers are completely out of reach for retaliation. They're extremely difficult to track down, and even when you do it's usually to a country that won't even consider extradition. So they can try again and again, and you have to catch them every time or they'll achieve their goal.