32 ms·

As any competent security executive would tell you, even if they had a unlimited budget, complete management support, all recommendations followed, and total co

by Veserv 3y ago

As any competent security executive would tell you, even if they had a unlimited budget, complete management support, all recommendations followed, and total control over business process short of utterly crippling operations, the cost of hiring a hacker to completely breach the best possible form of their system would still be less than 1 M$. Oh, but what about the banks? Yeah, those are the security executives who personally told me and my colleagues that when asked. They literally have 100 M$ budgets up to 1 G$ budgets and they said that. The problem is not money, the problem is that commercial IT security technology and vendors do not work against professional, financially-motivated threat actors.

wepple 3y ago
I disagree. With sufficient buy-in and money, you can make your systems extremely difficult and costly to attack, making the economics of an attack not worth it. I’m willing to bet that a place like MGM has utterly abysmal security. You don’t see regular attacks against top-tier companies because a lot of them invest a reasonable amount.
waihtis 3y ago
You're not wrong, but reading the autopsies of most of these 100M dollar incidents suggest that having a slightly above average detection posture would eliminate most of the damage.
- Veserv 3y ago
  Sure, in many of the post-mortems you can see that the attack probably only cost something like 10 K$ to execute. If their team did everything right they could literally make it 100x more secure. But that still only brings it to 1 M$. That is completely and utterly insufficient to stop the financially-motivated professional organized crime that are actively attacking them. This is not about theoretical attacks and threat actors, these are the people literally attacking them right now that they can not stop, that cause the most damage, and that can perform these attacks economically at 1 M$. To use the Caesar Entertainment incident that happened just before as a example, they purportedly paid a 15 M$ ransom. Is raising the cost to attack them from 10 K$ to 1 M$ really going to stop someone from collecting the 15 M$ payday? Oh no, I will only make 14 M$ instead of 14.99 M$, no point in attacking them. No, that is ridiculous. Making it harder is not a solution, you need to make it unprofitable. If it is profitable you will eventually be hit by a incident and that incident can be unboundedly bad all the way up to completely destroying your business. In addition, your susceptibility is not random. A targeted attack will succeed and will be wildly profitable to perform no matter what you do. This is not a "I need to outrun you, not the bear" scenario. The bear is very hungry and can catch both of you; it will eat the fatter and tastier one, not the slower one. Then it will catch and eat the other one. Your only protection is being less tasty so you get eaten last. You need to make it unprofitable and no extant solution available today in commercial IT can make it unprofitable for financially-motivated professional attackers. "Best practices" are maybe 1-10% of the way to minimally adequate; we need solutions 10 to 100 times better than the current gold standard to get there. Yes, I said times, not percent. We need a 1,000% to 10,000% improvement to get to the minimum bar. Until then, buckle in since things are just getting started; we are in for some real wild times on this ride.
  - waihtis 3y ago
    Will repeat that you're definitely not wrong. What do you think could be done to increase the standard of security to the required level?
    - Veserv 3y ago
      That is... tough. Do you want to know what you can do for yourself, or what society can do to fix the problem? If you are considering for yourself, then there is the short term and long term view. The short term view is that the cost of compromise is still low. As I said in a sibling comment, the cyberattack industry is still going through growing pains, so from a practical perspective, if you chart out the rate of cyberattack growth, you still have maybe 5-10 more years of coasting before things become a existential-threat sort of problem if you are running a big business. For instance, MGM made 14 G$ in revenue last year, 100 M$ is a pain, but not life threatening. With 5 more years of sophistication they can probably make that 1-3 G$ and then you are in for a real world of pain. The long term view is to assume that every element of your system that is network connected is easily hacked. Then you need to redesign your system and processes around that assumption. All of the conveniences of network connectivity are going to be liabilities. With careful thought you can probably reorganize your systems around this assumption for a relatively modest impact to operations. This will not protect you per se, but it will make your business processes more robust. The usual thing you lose by minimizing system connectivity is that latency gets worse, but you can usually mitigate this with more batch processing. Your turnaround time gets worse, but your bandwidth stays the same. There are costs to redesigning your business processes like this, but they are a lot less than the hecklers claim since you will not use the exact same processes that assume low latency always-connected systems, you will change your processes to better suit the new normal. Unfortunately, I can not give you much more than a high level view here because it is very business specific. If you are considering society, then the core problem is that the incentive structure is all messed up. Software deployment has no requirements on fitness for purpose and software companies can basically just lie about software security with total impunity are just two of the obvious problems. Unlike basically every other industry, where your product has to nominally work, software basically has no expectation or requirement of working no matter the use case. You can use whatever crappy software you find to run a nuclear power plant and nobody bats a eye. That is ridiculous. Deploying software that is unfit for a use case should not be allowed. However, the definition of fitness depends on the use case and the criticality, no one size fits all set of requirements works. This is like how we have different standards for toys and bridges. This is how literally every other industry works. The EU Cyber Resilience Act supposedly has some of this, but I have not read it directly to comment on the specific implementation they did. The other problem is that software companies are allowed to basically just lie about software security. Have you ever heard any company say anything other than "our product is secure" or "we have the most secure {X}"? These are meaningless terms. I propose that if you want to advertise security, you can say a dollar amount "our bank is secure against 15 M$ attacks", but then you need to put up a bug bounty for that amount. You want to lie and say 1 G$ when you know it is 10 M$, go ahead, you are going to lose your shirt. Also, to handle the consumer product angle you could divide the number by the number of devices or some fraction thereof. Yeah, 10 M$ might sound like a lot to a regular person, but if they can hack all 1 M of the units then they only need to get 10 $ per unit to make it worthwhile, so you really only have 10 $ of marginal security for your device. I did not really directly answer your question though. If you really need to increase your security to the required level, then there is not much you can do. There is nothing currently available on the market that can do that and none of the current vendors is able to solve the problem. Basically anybody using the same old tired cybersecurity pitches is just selling you junk and anybody with a new spin on it is also probably junk. If you want real verification demand robust auditable test suites, unrestricted red team tests, formal specifications, and proofs of correctness. Those are basically impossible to fake and none of the clowns will be able to provide a semblance of those. Unfortunately, basically everybody is a clown, so all that will really happen is that you will find that there are no viable vendors. Sorry I can not be of much help. The industry is a wasteland right now; we need to nurture solutions before we can use them.
rurp 3y ago
I find this hard to believe, given the current state of the world. If it were really as easy as hiring a hacker for <$1M to hack any given company then hundreds would be hacked every week. There are an awful lot of businesses that would pay a sizable ransom rather than let their business be destroyed, or have a large amount of funds that can be stolen, or have valuable data. I think the reality is more that most well prepared companies can be hacked, but that it takes a lot of resources, and that there are a number of companies with atrocious security that can be hacked with a moderate amount of effort.
- Veserv 3y ago
  First of all, tens to hundreds of companies are being hacked every week. The exact numbers are hard to exactly determine since they are not required to disclose the information. Here is a publicly available report on the state of ransomware in 2023 [1]. Of 3,000 respondents 66% were hit by a ransomware attack in 2023. So right there we have ~2,000 successful attacks which would be ~40 per week, just from the companies directly surveyed. The rates are consistent across company size, so if we assume it is representative of large companies then over the probably tens to hundreds of thousands of companies with over 50 M$ in revenue, that would be tens of thousands of successful attacks per year averaging out to hundreds to thousands per week. And that is just ransomware. Second of all, 1 M$ of hacking resources is like one or two person-years of skilled hacking labor. The counterfactual scenario you are considering appears to be tens of thousands of companies being hacked for 10 M$ per for a total of 100 G$ of revenue per year. Do you realize what you are expecting there? You wonder why 18 year old hacking nerds could not bootstrap a 100 billion dollar per year business (more than the estimated revenue of the entire illegal drug trade in the US and similar to the revenue of Facebook) with no venture capital and train and hire 10,000 skilled hackers (nearly a entire Google's worth of software developers) in under 10 years? Give them a break, 10 years after Facebook was founded they only made 12 G$/year and you are expecting some kids with no support structure to do 8x that while bootstrapping. For the world to look like your counterfactual, they would need 1,000% YoY growth for a entire decade; that is ludicrous. I hope it is now clear that the reason everybody is not being hacked all the time is because there has not been enough time to grow into that yet. They are trying really hard though. Look at that report again. The mean ransom payment doubled from 2022 and the rate of high end payments quadrupled. In some other reports (that are behind signup walls), the number of attacks has been tripling YoY and the mean payment/ask has been tripling YoY for the past 5-10 years. That growth curve looks like a wall. The 18 year old hacker nerds who started these criminal enterprises 10 years ago are now 28 year old business people with 10 years of experience under their belt and have access to real organized crime support structures. This is why the attacks are growing so quickly, this is a greenfield opportunity that everybody is rushing to exploit as quickly as they can, but there are real limits to training talent and bootstrapping. Give them some time, we'll get there. [1] https://assets.sophos.com/X24WTUEQ/at/c949g7693gsnjh9rb9gr8/sophos-state-of-ransomware-2023-wp.pdf https://assets.sophos.com/X24WTUEQ/at/c949g7693gsnjh9rb9gr8/...

by Veserv 3y ago

wepple 3y ago

I disagree. With sufficient buy-in and money, you can make your systems extremely difficult and costly to attack, making the economics of an attack not worth it. I’m willing to bet that a place like MGM has utterly abysmal security. You don’t see regular attacks against top-tier companies because a lot of them invest a reasonable amount.

waihtis 3y ago

You're not wrong, but reading the autopsies of most of these 100M dollar incidents suggest that having a slightly above average detection posture would eliminate most of the damage.

Veserv 3y ago
Sure, in many of the post-mortems you can see that the attack probably only cost something like 10 K$ to execute. If their team did everything right they could literally make it 100x more secure. But that still only brings it to 1 M$. That is completely and utterly insufficient to stop the financially-motivated professional organized crime that are actively attacking them. This is not about theoretical attacks and threat actors, these are the people literally attacking them right now that they can not stop, that cause the most damage, and that can perform these attacks economically at 1 M$. To use the Caesar Entertainment incident that happened just before as a example, they purportedly paid a 15 M$ ransom. Is raising the cost to attack them from 10 K$ to 1 M$ really going to stop someone from collecting the 15 M$ payday? Oh no, I will only make 14 M$ instead of 14.99 M$, no point in attacking them. No, that is ridiculous. Making it harder is not a solution, you need to make it unprofitable. If it is profitable you will eventually be hit by a incident and that incident can be unboundedly bad all the way up to completely destroying your business. In addition, your susceptibility is not random. A targeted attack will succeed and will be wildly profitable to perform no matter what you do. This is not a "I need to outrun you, not the bear" scenario. The bear is very hungry and can catch both of you; it will eat the fatter and tastier one, not the slower one. Then it will catch and eat the other one. Your only protection is being less tasty so you get eaten last. You need to make it unprofitable and no extant solution available today in commercial IT can make it unprofitable for financially-motivated professional attackers. "Best practices" are maybe 1-10% of the way to minimally adequate; we need solutions 10 to 100 times better than the current gold standard to get there. Yes, I said times, not percent. We need a 1,000% to 10,000% improvement to get to the minimum bar. Until then, buckle in since things are just getting started; we are in for some real wild times on this ride.
- waihtis 3y ago
  Will repeat that you're definitely not wrong. What do you think could be done to increase the standard of security to the required level?
  - Veserv 3y ago
    That is... tough. Do you want to know what you can do for yourself, or what society can do to fix the problem? If you are considering for yourself, then there is the short term and long term view. The short term view is that the cost of compromise is still low. As I said in a sibling comment, the cyberattack industry is still going through growing pains, so from a practical perspective, if you chart out the rate of cyberattack growth, you still have maybe 5-10 more years of coasting before things become a existential-threat sort of problem if you are running a big business. For instance, MGM made 14 G$ in revenue last year, 100 M$ is a pain, but not life threatening. With 5 more years of sophistication they can probably make that 1-3 G$ and then you are in for a real world of pain. The long term view is to assume that every element of your system that is network connected is easily hacked. Then you need to redesign your system and processes around that assumption. All of the conveniences of network connectivity are going to be liabilities. With careful thought you can probably reorganize your systems around this assumption for a relatively modest impact to operations. This will not protect you per se, but it will make your business processes more robust. The usual thing you lose by minimizing system connectivity is that latency gets worse, but you can usually mitigate this with more batch processing. Your turnaround time gets worse, but your bandwidth stays the same. There are costs to redesigning your business processes like this, but they are a lot less than the hecklers claim since you will not use the exact same processes that assume low latency always-connected systems, you will change your processes to better suit the new normal. Unfortunately, I can not give you much more than a high level view here because it is very business specific. If you are considering society, then the core problem is that the incentive structure is all messed up. Software deployment has no requirements on fitness for purpose and software companies can basically just lie about software security with total impunity are just two of the obvious problems. Unlike basically every other industry, where your product has to nominally work, software basically has no expectation or requirement of working no matter the use case. You can use whatever crappy software you find to run a nuclear power plant and nobody bats a eye. That is ridiculous. Deploying software that is unfit for a use case should not be allowed. However, the definition of fitness depends on the use case and the criticality, no one size fits all set of requirements works. This is like how we have different standards for toys and bridges. This is how literally every other industry works. The EU Cyber Resilience Act supposedly has some of this, but I have not read it directly to comment on the specific implementation they did. The other problem is that software companies are allowed to basically just lie about software security. Have you ever heard any company say anything other than "our product is secure" or "we have the most secure {X}"? These are meaningless terms. I propose that if you want to advertise security, you can say a dollar amount "our bank is secure against 15 M$ attacks", but then you need to put up a bug bounty for that amount. You want to lie and say 1 G$ when you know it is 10 M$, go ahead, you are going to lose your shirt. Also, to handle the consumer product angle you could divide the number by the number of devices or some fraction thereof. Yeah, 10 M$ might sound like a lot to a regular person, but if they can hack all 1 M of the units then they only need to get 10 $ per unit to make it worthwhile, so you really only have 10 $ of marginal security for your device. I did not really directly answer your question though. If you really need to increase your security to the required level, then there is not much you can do. There is nothing currently available on the market that can do that and none of the current vendors is able to solve the problem. Basically anybody using the same old tired cybersecurity pitches is just selling you junk and anybody with a new spin on it is also probably junk. If you want real verification demand robust auditable test suites, unrestricted red team tests, formal specifications, and proofs of correctness. Those are basically impossible to fake and none of the clowns will be able to provide a semblance of those. Unfortunately, basically everybody is a clown, so all that will really happen is that you will find that there are no viable vendors. Sorry I can not be of much help. The industry is a wasteland right now; we need to nurture solutions before we can use them.

rurp 3y ago

I find this hard to believe, given the current state of the world. If it were really as easy as hiring a hacker for <$1M to hack any given company then hundreds would be hacked every week. There are an awful lot of businesses that would pay a sizable ransom rather than let their business be destroyed, or have a large amount of funds that can be stolen, or have valuable data. I think the reality is more that most well prepared companies can be hacked, but that it takes a lot of resources, and that there are a number of companies with atrocious security that can be hacked with a moderate amount of effort.

Veserv 3y ago
First of all, tens to hundreds of companies are being hacked every week. The exact numbers are hard to exactly determine since they are not required to disclose the information. Here is a publicly available report on the state of ransomware in 2023 [1]. Of 3,000 respondents 66% were hit by a ransomware attack in 2023. So right there we have ~2,000 successful attacks which would be ~40 per week, just from the companies directly surveyed. The rates are consistent across company size, so if we assume it is representative of large companies then over the probably tens to hundreds of thousands of companies with over 50 M$ in revenue, that would be tens of thousands of successful attacks per year averaging out to hundreds to thousands per week. And that is just ransomware. Second of all, 1 M$ of hacking resources is like one or two person-years of skilled hacking labor. The counterfactual scenario you are considering appears to be tens of thousands of companies being hacked for 10 M$ per for a total of 100 G$ of revenue per year. Do you realize what you are expecting there? You wonder why 18 year old hacking nerds could not bootstrap a 100 billion dollar per year business (more than the estimated revenue of the entire illegal drug trade in the US and similar to the revenue of Facebook) with no venture capital and train and hire 10,000 skilled hackers (nearly a entire Google's worth of software developers) in under 10 years? Give them a break, 10 years after Facebook was founded they only made 12 G$/year and you are expecting some kids with no support structure to do 8x that while bootstrapping. For the world to look like your counterfactual, they would need 1,000% YoY growth for a entire decade; that is ludicrous. I hope it is now clear that the reason everybody is not being hacked all the time is because there has not been enough time to grow into that yet. They are trying really hard though. Look at that report again. The mean ransom payment doubled from 2022 and the rate of high end payments quadrupled. In some other reports (that are behind signup walls), the number of attacks has been tripling YoY and the mean payment/ask has been tripling YoY for the past 5-10 years. That growth curve looks like a wall. The 18 year old hacker nerds who started these criminal enterprises 10 years ago are now 28 year old business people with 10 years of experience under their belt and have access to real organized crime support structures. This is why the attacks are growing so quickly, this is a greenfield opportunity that everybody is rushing to exploit as quickly as they can, but there are real limits to training talent and bootstrapping. Give them some time, we'll get there. [1] https://assets.sophos.com/X24WTUEQ/at/c949g7693gsnjh9rb9gr8/sophos-state-of-ransomware-2023-wp.pdf https://assets.sophos.com/X24WTUEQ/at/c949g7693gsnjh9rb9gr8/...