5 ms·

This is intensely defeatist. Regulations and compliance are essentially what you described and they work for banks (despite the clever responses I'm sure are in

This is intensely defeatist. Regulations and compliance are essentially what you described and they work for banks (despite the clever responses I'm sure are incoming). For the critical industry sectors they need to be buying the 50k appliance. And they need to be looking at a checklist that they only want to complete to avoid fines. Culture will accrete later.

hedora 3y ago
I disagree with the GP’s approach of defunding education to improve education, but I’ve seen the culture that accretes from checklists and expensive security appliances. Everyone involved correctly comes to the conclusion that the company’s security policy is purely performative. The people that care leave. The people that don’t care about securing the system implement the useless checkboxes and put the standalone box in the correct room (and might even plug it in), then get promoted. FIPS security certifications are the poster child for this. There’s basically no way to get a securely architected system certified, so you end up adding vulnerabilities and (in the best case) a configuration parameter like the old “enable FIPS certification (default off; do not enable unless you are required to do so)” button from windows.
kortilla 3y ago
50k appliance doesn’t do shit if people work from their personal laptop and use shared passwords. The only thing a regulation that mandates a 50k appliance will do is boost the appliance makers sales.
- hinkley 3y ago
  An appliance also externalizes responsibility. I don’t need to think of anything, because we have the box that goes, “ping”.
Veserv 3y ago
It emphatically does not work for banks. They spend hundreds of millions of dollars a year and any bank CISO would tell you, off the record, that their systems could be completely breached for less then a million dollars. That is not because they suck at doing it, that is because commercial cybersecurity is just plain garbage. That is literally the best you can get no matter how much you spend and no matter how “good” your people are if you use commercial IT security practices. Nobody does better than that who uses anything from a big brand cybersecurity vendor. The only reason banks are not totally wrecked by cyberattacks is that: 1) They actually are being constantly attacked by ransomware and the like, they just do not disclose it; I do not remember the budget line item the payments all go under but it is one of those compliance/administrative ones such as for insurance. 2) Cyberattacks, contrary to their standard portrayal as always being run by “state-sponsored” groups to make the companys being destroyed look better, are largely run by kids. They are largely unsophisticated on financial and business matters so do not know how much to ask for, how to maximally leverage a breach as a first party (i.e. do not know how to use say investment bank deal details to do effective trades), and how to actually cash out large amounts of money undetectably. 3) The non cybersecurity processes and fraud detection are actually fairly effective. There are large number of accounting checks in place that make it very hard to do simple hacks (like make the numbers in one account higher) that can not be detected. Banks have the equivalent of very complex, bespoke DRM systems that requires knowledge of financial systems and of their internal processes to crack. As I said before, the hackers are largely financially unsophisticated, so it is very hard for them to do this. No, it is intensely defeatist to just give up on actually solving the problem and demanding useless security theater in the vain hopes that it will somehow improve the situation.
- tredre3 3y ago
  Regulations and rules force banks to be held accountable. Whether or not their cybersecurity prevents all breaches is besides the point. They are incentive in minimizing breaches, and when one occurs they're the one who have to cover the losses (yes I'm sure you're already typing clever examples of banks avoiding responsibility that one time but the fact that we rarely hear about then, as you say yourself, is that they cover it up and refund all the losses themselves). > demanding useless security theater in the vain hopes that it will somehow improve the situation. The security theatre required by these new rules might not prevent all breaches, or any breaches, but they will force utilities to be accountable for their failures. No longer will it be "Oopsie, mean hacker hacked us. Not our fault. Whatchugonna do anyway? Your business had to shutdown because no power/internet? Tough luck I guess". Now it will be "Oh fuck, hackers got in. We'll have to cover our customers losses and spend millions in PR to spin the story and avoid total bankruptcy." Do you really not see how that's still an improvement?
  - hedora 3y ago
    That’s not what regulators do in this space. Instead, the rules are of the form “use certified vendor, and you will be shielded from liability”. Also, the vendors and the people being shielded largely write the rules.
  - Veserv 3y ago
    No, liability requirements force banks to be held accountable. They do eat most of the costs of the direct consequences of being hacked. Luckily for them, the people hacking them are still, frankly, inexperienced from a business perspective so their losses have to this point been largely immaterial. The losses are not low because the cybersecurity processes and regulations are good, they are low because even though the vault is being guarded by the metaphorical equivalent a chihuahua, all they are doing is stealing the pens because they do not know how to pawn the gold in bulk. This state of affairs is changing very quickly. 15 years ago the hackers were walking into the vault and asking for $1,000 because they were 16 year olds who thought that was a lot of money. Now the good ones are 30 years old and are still walking into the vault, but asking for $10,000,000. Last I saw the number of attacks was increasing 3x year over year and the average ask was increasing 3x year over year. The entire cybersecurity insurance industry is already underwater at current premiums. I have heard they have basically stopped issuing policys over a few million dollars because it is literally ruinous. It is no longer becoming possible to paper over the omnipresent security deficiencys with insurance, betting on the incompetence of the attackers, and betting only one of you is going to get eaten. The sensible solution right now would be liability requirements on advertising security. You can not insinuate you are “secure” whatever that even means. You can instead only advertise a dollar amount per customer which is tied to a mandatory bug bounty. If you are a big bank with 100 million customers, you can put up a 10 billion dollar bug bounty on breaching your systems and then you can advertise $100 of security on your customer deposits. This would force them to put their money where their mouth is while not preventing new small companys from existing as long as they truthfully report that they are not providing security. It would also help us pull the customer desired security requirements forward in time instead of waiting for the destruction first. Absent that, what is going to happen is that everybody keeps lying about their security to trick their customers into trusting them. Then one of them is going to get hit by a truly expensive attack and all the customers will be caught with their pants down. The only technical solution to this is either dropping reliance on these easily hacked systems, or throwing out all the existing crap that was never designed for security and can thus never be retrofitted to be secure such as Microsoft, Linux, Cisco, and Crowdstrike. Instead we must deploy systems designed for security such as those targeted to conform to the (now deprecated) Orange Book Class A1 or Common Criteria EAL 6/7 systems which are certified and proven to resist nation state attackers such as the NSA.
balderdash 3y ago
Regulations and compliance is not what is being proposed here.
kodah 3y ago
Regulations are rules, this is a formalized incentive structure. They're a tad different. Regulation is good to a degree; there's a balance to strike between overly burdensome regulation and regulation which basically may as well not exist. The lines between these are sometimes vague as the times evolve and are also subject to regulatory capture by interest groups (political groups and companies). The incentive structure generally makes spending money free or more free so long as an entity abides by the guidelines set out by the incentive. You need both and both need to reflect the correct goals for the times.
akira2501 3y ago
> This is intensely defeatist. It's realistic. > Regulations and compliance Which might be nice. "Do this, or you will be penalized like this." These are marketed as "incentives" which is "Buy something, anything, and here's some abstract additional cash." > And they need to be looking at a checklist that they only want to complete to avoid fines The problem here is, you do the checklist, and you get an incentive. I wonder how that's actually going to be implemented?

hedora 3y ago

I disagree with the GP’s approach of defunding education to improve education, but I’ve seen the culture that accretes from checklists and expensive security appliances. Everyone involved correctly comes to the conclusion that the company’s security policy is purely performative. The people that care leave. The people that don’t care about securing the system implement the useless checkboxes and put the standalone box in the correct room (and might even plug it in), then get promoted. FIPS security certifications are the poster child for this. There’s basically no way to get a securely architected system certified, so you end up adding vulnerabilities and (in the best case) a configuration parameter like the old “enable FIPS certification (default off; do not enable unless you are required to do so)” button from windows.

kortilla 3y ago

50k appliance doesn’t do shit if people work from their personal laptop and use shared passwords. The only thing a regulation that mandates a 50k appliance will do is boost the appliance makers sales.

hinkley 3y ago
An appliance also externalizes responsibility. I don’t need to think of anything, because we have the box that goes, “ping”.

Veserv 3y ago

It emphatically does not work for banks. They spend hundreds of millions of dollars a year and any bank CISO would tell you, off the record, that their systems could be completely breached for less then a million dollars. That is not because they suck at doing it, that is because commercial cybersecurity is just plain garbage. That is literally the best you can get no matter how much you spend and no matter how “good” your people are if you use commercial IT security practices. Nobody does better than that who uses anything from a big brand cybersecurity vendor. The only reason banks are not totally wrecked by cyberattacks is that: 1) They actually are being constantly attacked by ransomware and the like, they just do not disclose it; I do not remember the budget line item the payments all go under but it is one of those compliance/administrative ones such as for insurance. 2) Cyberattacks, contrary to their standard portrayal as always being run by “state-sponsored” groups to make the companys being destroyed look better, are largely run by kids. They are largely unsophisticated on financial and business matters so do not know how much to ask for, how to maximally leverage a breach as a first party (i.e. do not know how to use say investment bank deal details to do effective trades), and how to actually cash out large amounts of money undetectably. 3) The non cybersecurity processes and fraud detection are actually fairly effective. There are large number of accounting checks in place that make it very hard to do simple hacks (like make the numbers in one account higher) that can not be detected. Banks have the equivalent of very complex, bespoke DRM systems that requires knowledge of financial systems and of their internal processes to crack. As I said before, the hackers are largely financially unsophisticated, so it is very hard for them to do this. No, it is intensely defeatist to just give up on actually solving the problem and demanding useless security theater in the vain hopes that it will somehow improve the situation.

tredre3 3y ago
Regulations and rules force banks to be held accountable. Whether or not their cybersecurity prevents all breaches is besides the point. They are incentive in minimizing breaches, and when one occurs they're the one who have to cover the losses (yes I'm sure you're already typing clever examples of banks avoiding responsibility that one time but the fact that we rarely hear about then, as you say yourself, is that they cover it up and refund all the losses themselves). > demanding useless security theater in the vain hopes that it will somehow improve the situation. The security theatre required by these new rules might not prevent all breaches, or any breaches, but they will force utilities to be accountable for their failures. No longer will it be "Oopsie, mean hacker hacked us. Not our fault. Whatchugonna do anyway? Your business had to shutdown because no power/internet? Tough luck I guess". Now it will be "Oh fuck, hackers got in. We'll have to cover our customers losses and spend millions in PR to spin the story and avoid total bankruptcy." Do you really not see how that's still an improvement?
- hedora 3y ago
  That’s not what regulators do in this space. Instead, the rules are of the form “use certified vendor, and you will be shielded from liability”. Also, the vendors and the people being shielded largely write the rules.
- Veserv 3y ago
  No, liability requirements force banks to be held accountable. They do eat most of the costs of the direct consequences of being hacked. Luckily for them, the people hacking them are still, frankly, inexperienced from a business perspective so their losses have to this point been largely immaterial. The losses are not low because the cybersecurity processes and regulations are good, they are low because even though the vault is being guarded by the metaphorical equivalent a chihuahua, all they are doing is stealing the pens because they do not know how to pawn the gold in bulk. This state of affairs is changing very quickly. 15 years ago the hackers were walking into the vault and asking for $1,000 because they were 16 year olds who thought that was a lot of money. Now the good ones are 30 years old and are still walking into the vault, but asking for $10,000,000. Last I saw the number of attacks was increasing 3x year over year and the average ask was increasing 3x year over year. The entire cybersecurity insurance industry is already underwater at current premiums. I have heard they have basically stopped issuing policys over a few million dollars because it is literally ruinous. It is no longer becoming possible to paper over the omnipresent security deficiencys with insurance, betting on the incompetence of the attackers, and betting only one of you is going to get eaten. The sensible solution right now would be liability requirements on advertising security. You can not insinuate you are “secure” whatever that even means. You can instead only advertise a dollar amount per customer which is tied to a mandatory bug bounty. If you are a big bank with 100 million customers, you can put up a 10 billion dollar bug bounty on breaching your systems and then you can advertise $100 of security on your customer deposits. This would force them to put their money where their mouth is while not preventing new small companys from existing as long as they truthfully report that they are not providing security. It would also help us pull the customer desired security requirements forward in time instead of waiting for the destruction first. Absent that, what is going to happen is that everybody keeps lying about their security to trick their customers into trusting them. Then one of them is going to get hit by a truly expensive attack and all the customers will be caught with their pants down. The only technical solution to this is either dropping reliance on these easily hacked systems, or throwing out all the existing crap that was never designed for security and can thus never be retrofitted to be secure such as Microsoft, Linux, Cisco, and Crowdstrike. Instead we must deploy systems designed for security such as those targeted to conform to the (now deprecated) Orange Book Class A1 or Common Criteria EAL 6/7 systems which are certified and proven to resist nation state attackers such as the NSA.

balderdash 3y ago

Regulations and compliance is not what is being proposed here.

kodah 3y ago

Regulations are rules, this is a formalized incentive structure. They're a tad different. Regulation is good to a degree; there's a balance to strike between overly burdensome regulation and regulation which basically may as well not exist. The lines between these are sometimes vague as the times evolve and are also subject to regulatory capture by interest groups (political groups and companies). The incentive structure generally makes spending money free or more free so long as an entity abides by the guidelines set out by the incentive. You need both and both need to reflect the correct goals for the times.

akira2501 3y ago

> This is intensely defeatist. It's realistic. > Regulations and compliance Which might be nice. "Do this, or you will be penalized like this." These are marketed as "incentives" which is "Buy something, anything, and here's some abstract additional cash." > And they need to be looking at a checklist that they only want to complete to avoid fines The problem here is, you do the checklist, and you get an incentive. I wonder how that's actually going to be implemented?