4 ms·

Do you think there’s a standard for “incredibly hard” that all applications need to follow? Or that it varies from one application to another depending on conte

Do you think there’s a standard for “incredibly hard” that all applications need to follow? Or that it varies from one application to another depending on context?

blagie 3y ago
It depends on context. There are many pieces here: 1) Cost of compromise. - For example, medical data, military secrets, and highly-personal data need a high level of security. - Something like Sudoku high scores, perhaps not so much. 2) Benefit of compromise. Some compromises net $0, and some $1M. - Something used by 4B users (like Google) has much higher potential upside than something used by 1 user. If someone can scam-at-scale, that's a lot of money. - Something managing $4B of bitcoin or with designs for the F35 has much higher upside than something with Sudoku high scores. 3) Exposure. - A script I wrote which I run on my local computer doesn't need any security. It's like my bedroom door. - A one-off home, school, or business-internal system is only exposed to those communities, and doesn't need to be excessively hardened. It's more-or-less the same as physical security. - Something on the public internet needs a lot more. This, again, speaks to number of potential attackers (0, dozens/hundreds, or 7B). #1 and #2 are obvious. #3 is the one where I see people screw up with arguments. Threats which seem absurdly unlikely are exploited all the time on the public internet, and intuition from the real world doesn't translate at all.
- blowski 3y ago
  If I’m reading you right, if a business had a non-critical internal system (internal network behind a strong VPN) with the potential for a CSRF attack, you wouldn’t call that a risk?
  - blagie 3y ago
    It's a risk. Having is having glass windows (at least at street level). Whether it's a risk worth addressing depends on a lot of specifics. For example, a CSRF attack on something like sharepoint.business.com could be externally exploited with automated exploits. That brings you to the 7B attacker scenario, and if the business has 100,000 employees, likely one of them will hit on an attack. A CSRF attack on a custom application only five employees know about has decent security-by-obscurity. An attacker would need to know URLs and similar business-internal information, which only five people have access to. Those five people can just as easily walk into the CEOs office and physically compromise the machine.

Do you think there’s a standard for “incredibly hard” that all applications need to follow? Or that it varies from one application to another depending on context?

blagie 3y ago

It depends on context. There are many pieces here: 1) Cost of compromise. - For example, medical data, military secrets, and highly-personal data need a high level of security. - Something like Sudoku high scores, perhaps not so much. 2) Benefit of compromise. Some compromises net $0, and some $1M. - Something used by 4B users (like Google) has much higher potential upside than something used by 1 user. If someone can scam-at-scale, that's a lot of money. - Something managing $4B of bitcoin or with designs for the F35 has much higher upside than something with Sudoku high scores. 3) Exposure. - A script I wrote which I run on my local computer doesn't need any security. It's like my bedroom door. - A one-off home, school, or business-internal system is only exposed to those communities, and doesn't need to be excessively hardened. It's more-or-less the same as physical security. - Something on the public internet needs a lot more. This, again, speaks to number of potential attackers (0, dozens/hundreds, or 7B). #1 and #2 are obvious. #3 is the one where I see people screw up with arguments. Threats which seem absurdly unlikely are exploited all the time on the public internet, and intuition from the real world doesn't translate at all.

blowski 3y ago
If I’m reading you right, if a business had a non-critical internal system (internal network behind a strong VPN) with the potential for a CSRF attack, you wouldn’t call that a risk?
- blagie 3y ago
  It's a risk. Having is having glass windows (at least at street level). Whether it's a risk worth addressing depends on a lot of specifics. For example, a CSRF attack on something like sharepoint.business.com could be externally exploited with automated exploits. That brings you to the 7B attacker scenario, and if the business has 100,000 employees, likely one of them will hit on an attack. A CSRF attack on a custom application only five employees know about has decent security-by-obscurity. An attacker would need to know URLs and similar business-internal information, which only five people have access to. Those five people can just as easily walk into the CEOs office and physically compromise the machine.