9 ms·

That is such a presumtive baseless statement, what data do you have to back that up? What would fines do? People don't use azure ad because it's optional, it's

by _8j50 3y ago

That is such a presumtive baseless statement, what data do you have to back that up? What would fines do? People don't use azure ad because it's optional, it's how most companies these days authenticate users instead of onprem ad which has its own suite of issues. "Most crime wouldn't happen if home owners stopped storing valuables in their homes" yeah right. This is not a result if MS being negligent. You're victim blaming for karma points without even knowing how exactly the vuln works or was exploited.

vinyl7 3y ago
Except using azure ad is storing your valuables in someone else's house
- _8j50 3y ago
  No, using azuread is storing your valuables in someone else's safety deposit box! The service exists not just for convenience because it is more secure than azure ad. 90%+ ransomwared orgs in my estimate are vicitims of onprem AD abuse!
hilbert42 3y ago
"without even knowing how exactly the vuln works or was exploited." If you're offering a service you damn-well ought to know and fix it or it's not fit for purpose. QED. Read my caveat in respect of the above in my other post—re state of the art, employees bona fides etc. There is no logical difference between the rules for cyber security and any other industry. For instance, the Boeing 737 Max fuck-up was because of corporate greed and negligence. For some reason the software industry seems to assume a God-given right to be exempted. It's about time that changed. (If the software industry wants to be considered an engineering profession and treated as such then it has to obey standards as set by law and regulation like every other engineering profession on the planet.)
- _8j50 3y ago
  > There is no logical difference between the rules for cyber security and any other industry That's the problem with the way tech people who don't get infosec think. There is a huge difference! The entire purpose of cybersecurity is malicious human beings not bugs in software! To use your analogy this attack would be how that malaysian plane was shot down by a russian missile as opposed a malfunction in the 737. A chinese military/intel unit attacked microsoft, the real world equivalent would make you ask why the US military did not defend MS not why MS couldn't defend against a nation state actor that next to the US is the most resourced on the planet! > It's about time that changed It's about time you and others put the blame on threat actors and hold your military/intel apparatus accountable. Bugs happen, it is only MS's fault if they failed to follow best practices in securing their infra and code. No matter how hard you try or what process you use, things made by fallinle humans have a vulnerability waiting to be discovered.
  - hilbert42 3y ago
    "It's about time you and others put the blame on threat actors" Over the years we built mechanical safes for banks etc. Fort Knox still has its gold. We engineered that and it's largely worked well. Are you now telling me that this is beyond the capability of software engineering? If so, then we need to drop the word 'engineering' from 'software' and start completely a fresh. Talk about a defeatist attitude. This negative attitude is the real problem. OK, what's your solution to bring down cyber attacks from the billions per year to about the same tolerable level we have for banks and security for other physical objects? Fact: cyber security is not fit for purpose. Reality check: it's NOT working—the loss of millions of data records per day to cyber attacks attests to that. You solution please.... PS: 'engineering', by definition, is about finding solutions to problems.
    - _8j50 3y ago
      > Are you now telling me that this is beyond the capability of software engineering? If so, then we need to drop the word 'engineering' from 'software' and start completely a fresh. No. I am telling you that china sending a military specialops unit to break into fort knox is not a sign that fort knox was negligent. > Talk about a defeatist attitude. This negative attitude is the real problem. There is a difference between understanding real world dynamics and planning for them and being defeatist. Acknowledging disparities in resources and capabilities is not defeatist, it is risk assesment which you can plan around. In the infosec world it is one of the first rules for APTs that prevention is a failing strategy. There are entire courses and certifications you cam take and countless compromise case studies you can lean from. You cannot prevent an APT compromise but you can detect it and reduce dwell time. You can setup deception tech, collect a ton of logs and hunt for them (MS makes this difficult btw -- blame them on that if anything) and creat the most hostile environment for them to give you enough time to detect them before they do damage but you cannot prevent a compromise as a strategy. This is because they have more resources than even a company like MS and they are persistent (not neccesarily sophisticated). This is apt 101, they may get bored and move on to the next vicitim but that aside if China wants to hack MS, it will happen (as well the US and tencent)". The problem is you disagree with decades of infosec school of thought because as SWE (if I may presume -- or other non-infosec tech person) you are used to solving problems of a technical nature and evem though I clearly tried to explain that this isn't a technology problem, you don't get it, and a lot of people (even newbies in infosec) don't get this. Lookip the "$5 wrench" xkcd for a humorous take in this. > OK, what's your solution to bring down cyber attacks from the billions per year to about the same tolerable level we have for banks and security for other physical objects? I don't need to solve it, how to slow down and catch apts is a solved problem. Look up twitter infosec threads on this compromise, many, self includes, are hoping MS will finally get their heads out their greedy arses and expose logs and apis that are usually very expensive to all their customers because of this for example. More logs, more/better detections from the infosec end of things is what everyone in infosec agrees on afaik. But in reality, our country needs to retaliate in kind and publicly against China as a detterrent (even if it means escalsting conflict), that is what is normally done when a foreign state attacks your private companies, the US military/IC are supposed to be our ultimate deterrent but people like you expect MS to do that when hacking back in retaliation by private companies is illegal (as it should be). > Fact: cyber security is not fit for purpose. Understand what "cybet security" means in this context first before you make generalist statements like that. > You solution please.... See above and other comments on thread from me > PS: 'engineering', by definition, is about finding solutions to problems. You should first understand the root cause of the problem (malicious humans, resource disparity and missing visibility) before trying to solve it. For example, the threat actors accessed outlook on government accounts right? Did the government have logs that could detect that? Did MS ? Was there enough detail in the logs? There are so many unanswered questions about the attack. We've been fighting apts for roughly 20yrs now, how to catch them and make life harder for them a discipline that is taught in detail. There is no silver bullet or magical perfectly impenetrable yet at the same time highly useful and complex system. Hats off to you though if you can replace azure ad with such a system and prove many wrong.

by _8j50 3y ago

vinyl7 3y ago

Except using azure ad is storing your valuables in someone else's house

_8j50 3y ago
No, using azuread is storing your valuables in someone else's safety deposit box! The service exists not just for convenience because it is more secure than azure ad. 90%+ ransomwared orgs in my estimate are vicitims of onprem AD abuse!

hilbert42 3y ago

"without even knowing how exactly the vuln works or was exploited." If you're offering a service you damn-well ought to know and fix it or it's not fit for purpose. QED. Read my caveat in respect of the above in my other post—re state of the art, employees bona fides etc. There is no logical difference between the rules for cyber security and any other industry. For instance, the Boeing 737 Max fuck-up was because of corporate greed and negligence. For some reason the software industry seems to assume a God-given right to be exempted. It's about time that changed. (If the software industry wants to be considered an engineering profession and treated as such then it has to obey standards as set by law and regulation like every other engineering profession on the planet.)

_8j50 3y ago
> There is no logical difference between the rules for cyber security and any other industry That's the problem with the way tech people who don't get infosec think. There is a huge difference! The entire purpose of cybersecurity is malicious human beings not bugs in software! To use your analogy this attack would be how that malaysian plane was shot down by a russian missile as opposed a malfunction in the 737. A chinese military/intel unit attacked microsoft, the real world equivalent would make you ask why the US military did not defend MS not why MS couldn't defend against a nation state actor that next to the US is the most resourced on the planet! > It's about time that changed It's about time you and others put the blame on threat actors and hold your military/intel apparatus accountable. Bugs happen, it is only MS's fault if they failed to follow best practices in securing their infra and code. No matter how hard you try or what process you use, things made by fallinle humans have a vulnerability waiting to be discovered.
- hilbert42 3y ago
  "It's about time you and others put the blame on threat actors" Over the years we built mechanical safes for banks etc. Fort Knox still has its gold. We engineered that and it's largely worked well. Are you now telling me that this is beyond the capability of software engineering? If so, then we need to drop the word 'engineering' from 'software' and start completely a fresh. Talk about a defeatist attitude. This negative attitude is the real problem. OK, what's your solution to bring down cyber attacks from the billions per year to about the same tolerable level we have for banks and security for other physical objects? Fact: cyber security is not fit for purpose. Reality check: it's NOT working—the loss of millions of data records per day to cyber attacks attests to that. You solution please.... PS: 'engineering', by definition, is about finding solutions to problems.
  - _8j50 3y ago
    > Are you now telling me that this is beyond the capability of software engineering? If so, then we need to drop the word 'engineering' from 'software' and start completely a fresh. No. I am telling you that china sending a military specialops unit to break into fort knox is not a sign that fort knox was negligent. > Talk about a defeatist attitude. This negative attitude is the real problem. There is a difference between understanding real world dynamics and planning for them and being defeatist. Acknowledging disparities in resources and capabilities is not defeatist, it is risk assesment which you can plan around. In the infosec world it is one of the first rules for APTs that prevention is a failing strategy. There are entire courses and certifications you cam take and countless compromise case studies you can lean from. You cannot prevent an APT compromise but you can detect it and reduce dwell time. You can setup deception tech, collect a ton of logs and hunt for them (MS makes this difficult btw -- blame them on that if anything) and creat the most hostile environment for them to give you enough time to detect them before they do damage but you cannot prevent a compromise as a strategy. This is because they have more resources than even a company like MS and they are persistent (not neccesarily sophisticated). This is apt 101, they may get bored and move on to the next vicitim but that aside if China wants to hack MS, it will happen (as well the US and tencent)". The problem is you disagree with decades of infosec school of thought because as SWE (if I may presume -- or other non-infosec tech person) you are used to solving problems of a technical nature and evem though I clearly tried to explain that this isn't a technology problem, you don't get it, and a lot of people (even newbies in infosec) don't get this. Lookip the "$5 wrench" xkcd for a humorous take in this. > OK, what's your solution to bring down cyber attacks from the billions per year to about the same tolerable level we have for banks and security for other physical objects? I don't need to solve it, how to slow down and catch apts is a solved problem. Look up twitter infosec threads on this compromise, many, self includes, are hoping MS will finally get their heads out their greedy arses and expose logs and apis that are usually very expensive to all their customers because of this for example. More logs, more/better detections from the infosec end of things is what everyone in infosec agrees on afaik. But in reality, our country needs to retaliate in kind and publicly against China as a detterrent (even if it means escalsting conflict), that is what is normally done when a foreign state attacks your private companies, the US military/IC are supposed to be our ultimate deterrent but people like you expect MS to do that when hacking back in retaliation by private companies is illegal (as it should be). > Fact: cyber security is not fit for purpose. Understand what "cybet security" means in this context first before you make generalist statements like that. > You solution please.... See above and other comments on thread from me > PS: 'engineering', by definition, is about finding solutions to problems. You should first understand the root cause of the problem (malicious humans, resource disparity and missing visibility) before trying to solve it. For example, the threat actors accessed outlook on government accounts right? Did the government have logs that could detect that? Did MS ? Was there enough detail in the logs? There are so many unanswered questions about the attack. We've been fighting apts for roughly 20yrs now, how to catch them and make life harder for them a discipline that is taught in detail. There is no silver bullet or magical perfectly impenetrable yet at the same time highly useful and complex system. Hats off to you though if you can replace azure ad with such a system and prove many wrong.