4 ms·

The problem is not that the ransomware attackers attacked. It's the fact that $10 says they've been systematically underinvesting in security and nows it's biti

The problem is not that the ransomware attackers attacked. It's the fact that $10 says they've been systematically underinvesting in security and nows it's biting them in the a*. But it doesn't matter because they've basically managed to be come a monopoly through acquisitions and using the bludgeon of government regulation to ensure no competition occurs. The next step is to move to declare this critical national infrastructure and create all sorts of new obtuse rules and regulations that will be in the name of security, but will mostly be theater and whose only real effect will be to create tons of new "compliance" jobs by low skilled morons who couldn't cut it in a real security job and whose primary job will be preventing actual security and sapping energy from anyone who builds things, because "it's not on the checklist". Not to mention the dozens of new vendors who will pop up soliciting a product that will promise to ensure customers are in complaince with the new regulations. Meanwhile Joe blow will still be unable to get his prescription filled and have his personal health data stolen and sold all over the black market.

easyas124 3y ago
[flagged]
ethbr1 3y ago
> $10 says they've been systematically underinvesting in security and nows it's biting them in the a*. But it doesn't matter because they've basically managed to become a monopoly [...]. The next step is to move to declare this critical national infrastructure and create all sorts of new obtuseness rules and regulations [...] There really only need to be 3 for critical infrastructure. #1 - Patch your shit according to industry standards, and have documented audit records that you've done that in a timely manner. #2 - You're fair game for NSA and DoD offensive pen testing. Failed pen tests are responsibility disclosed, then reported to the market after delay. #3 - So goes CISO, so goes CEO. Along with a ban from leadership roles for a number of years (5?). The issue is that the CEOs of these companies hire fall-on-your-sword guy as CISO, ignore the issues / listen to their CISO glossing over deficiencies, then claim breaches came out of nowhere, fire the CISO, and repeat business as usual. It's not going to change until CEOs have a realistic expectation that deficiencies will be found and personal consequences when they are.
Veserv 3y ago
There is literally no point to "investing" in modern commercial IT cybersecurity. It is all a bunch of useless junk that is incompatible with creating systems with any meaningful security. The big banks are spending hundreds of millions to billions of dollars a year on that junk and their cybersecurity teams know they can not even stop small teams with a million dollar budget. Literal kids fresh out of college at the banks manage more money than that. That is literally the case across all industries in every field in every area with big tech being no exception. Almost certainly everybody you have heard about does not and has never had the slightest clue on how to protect against economically motivated, professional criminals; the kinds of attackers that are now commonplace and are expected to attack every commercial system in the modern threat landscape. This is not a problem of underinvestment, it is a problem of structural incompetence. Systems need to verifiably survive red team pentests with multi-million dollar budgets with exactly zero discovered vulnerabilities before we are even in range of reasonable solutions. Any standard lower than that is inadequate to demonstrate resistance to commonplace attacks and is not even worth discussing.
- adamsb6 3y ago
  There are two kinds of security. Nearly all of corporate America practices security by checklist and certification. This is not real security, it’s just CYA for careerists and legal challenges. Actual security is hard and almost no one does it. The people capable of it are rare and expensive. They’re probably not jumping at the opportunity to work at Optum for $80,000.
  - Veserv 3y ago
    And who does actual security? Certainly not Google, Apple, Microsoft, Palo Alto Networks, Crowdstrike, etc. If that is who you were going to bring up, none of those companies has ever developed and deployed a usable system secure against even middling adversaries with only a few million dollars of budget. You will find exactly zero people at those companies who would be willing to bet their job that a small team of say 3-5 skilled offensive specialists specifically targeting them and willing to expend a year of fulltime work (i.e. a few million dollars worth of personnel cost) would not be able to completely compromise any usable system they designed. Exactly zero of the recognized names can protect against economically-motivated professional criminals targeting you. All they even claim to do is make you the ROI of attacking you go from the industry average of 100x to a still wildly profitable 10x under the "You don't need to be faster than the hunters, you just need to be faster than the other dodos" theory. Unfortunately, that theory does not work when the hunters keep bringing more of their friends to eat mouth-watering dodos. I mean, the cyberattacks have only been increasing by like, 500% YoY for the last 10 years. Exponential growth that slow means you can keep outrunning the hunters for like 5-10 more years until they eat everybody.

easyas124 3y ago

[flagged]

ethbr1 3y ago

> $10 says they've been systematically underinvesting in security and nows it's biting them in the a*. But it doesn't matter because they've basically managed to become a monopoly [...]. The next step is to move to declare this critical national infrastructure and create all sorts of new obtuseness rules and regulations [...] There really only need to be 3 for critical infrastructure. #1 - Patch your shit according to industry standards, and have documented audit records that you've done that in a timely manner. #2 - You're fair game for NSA and DoD offensive pen testing. Failed pen tests are responsibility disclosed, then reported to the market after delay. #3 - So goes CISO, so goes CEO. Along with a ban from leadership roles for a number of years (5?). The issue is that the CEOs of these companies hire fall-on-your-sword guy as CISO, ignore the issues / listen to their CISO glossing over deficiencies, then claim breaches came out of nowhere, fire the CISO, and repeat business as usual. It's not going to change until CEOs have a realistic expectation that deficiencies will be found and personal consequences when they are.

Veserv 3y ago

There is literally no point to "investing" in modern commercial IT cybersecurity. It is all a bunch of useless junk that is incompatible with creating systems with any meaningful security. The big banks are spending hundreds of millions to billions of dollars a year on that junk and their cybersecurity teams know they can not even stop small teams with a million dollar budget. Literal kids fresh out of college at the banks manage more money than that. That is literally the case across all industries in every field in every area with big tech being no exception. Almost certainly everybody you have heard about does not and has never had the slightest clue on how to protect against economically motivated, professional criminals; the kinds of attackers that are now commonplace and are expected to attack every commercial system in the modern threat landscape. This is not a problem of underinvestment, it is a problem of structural incompetence. Systems need to verifiably survive red team pentests with multi-million dollar budgets with exactly zero discovered vulnerabilities before we are even in range of reasonable solutions. Any standard lower than that is inadequate to demonstrate resistance to commonplace attacks and is not even worth discussing.

adamsb6 3y ago
There are two kinds of security. Nearly all of corporate America practices security by checklist and certification. This is not real security, it’s just CYA for careerists and legal challenges. Actual security is hard and almost no one does it. The people capable of it are rare and expensive. They’re probably not jumping at the opportunity to work at Optum for $80,000.
- Veserv 3y ago
  And who does actual security? Certainly not Google, Apple, Microsoft, Palo Alto Networks, Crowdstrike, etc. If that is who you were going to bring up, none of those companies has ever developed and deployed a usable system secure against even middling adversaries with only a few million dollars of budget. You will find exactly zero people at those companies who would be willing to bet their job that a small team of say 3-5 skilled offensive specialists specifically targeting them and willing to expend a year of fulltime work (i.e. a few million dollars worth of personnel cost) would not be able to completely compromise any usable system they designed. Exactly zero of the recognized names can protect against economically-motivated professional criminals targeting you. All they even claim to do is make you the ROI of attacking you go from the industry average of 100x to a still wildly profitable 10x under the "You don't need to be faster than the hunters, you just need to be faster than the other dodos" theory. Unfortunately, that theory does not work when the hunters keep bringing more of their friends to eat mouth-watering dodos. I mean, the cyberattacks have only been increasing by like, 500% YoY for the last 10 years. Exponential growth that slow means you can keep outrunning the hunters for like 5-10 more years until they eat everybody.