5 ms·

I wonder how many more of these incidents will need to happen until everyone starts to take computer security seriously. How much longer will there be zero con

I wonder how many more of these incidents will need to happen until everyone starts to take computer security seriously. How much longer will there be zero consequences for offloading the risk of shoddy security to your users?

15457345234 3y ago
> everyone starts to take computer security seriously Weren't the last big attacks literally carried out by hackers exploiting security software? As in, the solarwinds thing, which was carried out on systems which were 'textbook secure' ? If you want a secure system, my advice would be to fall back to using dumb hardware terminals, VT100 style. Anything more complicated than that will have a backdoor.
- tempodox 3y ago
  Fair enough, a no-bullshit discussion on how to actually achieve security should be part of the process.
  - 15457345234 3y ago
    The issue is, actually having that discussion becomes very hard, because a lot of 'security consultants' basically rely on the commissions they get from selling that type of inherently-creating-a-single-point-of-compromise managementware. So all of the 'experts' you might draft in to give you helpful advice will be telling you exactly the opposite of what you should be doing, which is reducing your attack surface as much as possible; cutting down, not increasing, the number of apps installed. And don't get me started on MDMs, which are basically a rootkit that's only as benign as the guy sitting behind the operator panel.
- faeriechangling 3y ago
  I wouldn’t characterize solarwinds as “security software”, the product that got hit was classic up/down monitoring software.
- jart 3y ago
  Reuters said, "[t]he problems began last week after hackers gained access to Change Healthcare's information technology systems [...]" so it was probably because some airhead gave their login to the hacker over the phone. Social engineering accounts for 98% of all cyber-attacks. Highly intelligent people who are only accustomed to employing software don't understand this, because the only thing they're afraid of is their software getting exploited.
  - rolandog 3y ago
    My money is on some un-upgraded backend/frontend stuff due to "compatibility" and/or lack of budget to hire people to keep things patched and up-to-date.
    - 15457345234 3y ago
      Blah, when it comes to a target that large, hackers will insert a contractor into the role who can secure the relevant credentials. This is another reason the remote-work scenario is such an issue - it's so trivial when large numbers of people are working remotely to gain access to secure systems.
  - bradleyjg 3y ago
    Why are we shipping software that’s hard on the outside and soft on the inside? We know our customers have employees that will be socially engineered. Heck, let’s not be smug, “we” have employees that will be too.
    - TeMPOraL 3y ago
      > software that’s hard on the outside and soft on the inside So are tanks. And so are humans. Security is opposite to usefulness. If you harden your system thoroughly to the limit of possibility, it becomes a rock. Systems are made to do something, so some parts need to actually do that thing.
      - bradleyjg 3y ago
- mikewarot 3y ago
  >using dumb hardware terminals, VT100 style Those VT-100 terminals actually have Z80 CPUs in them, but even so, they connected to VAX or other computer systems, which are generally networked.
staplers 3y ago
Multi-trillions in defense spending and for what? Our country is crippled with ineptitude and hogtied by the billionaire plutocracy. The systems the masses depend on will crumble long before the ruling class notices. Look to our national elections as a grotesque reminder.
- DinaCoder99 3y ago
  Given how poorly our defense spending effects literally anything related to our security, I'd rather not discover what havoc our government might wreak on the internet.
- Amezarak 3y ago
  The US government as a whole already spends more on health care than it does on defense. 2022: 944 billion (Medicare), 805 billion (Medicaid). [1] We could add the VA health care system (approx 100 billion), CHIP (few tens of billions), ACA subsidies (tens of billions), other publicly owned medical services (???), and probably some more things we're forgetting. 753 billion requested by the WH in defense spending. [2] This probably does not encompass all defense spending period, but there's nothing else going to add many 100s of billions to even come close to the health care figure. The problem with the US medical system isn't that not enough dollars are being allocated to it. The US government as a whole (state and federal) is already spending as much per capita as many European countries. We just don't get as much for it. I think it's fair to say as you did that entire sectors of the US economy are being crippled by ineptitude, which I would say is institutional rather than personal. The problem is systemic and it's hard to see how it could ever be practically fixed. [1] https://www.cms.gov/data-research/statistics-trends-and-reports/national-health-expenditure-data/nhe-fact-sheet https://www.cms.gov/data-research/statistics-trends-and-repo... [2] https://www.defense.gov/News/Releases/Release/Article/2638711/the-department-of-defense-releases-the-presidents-fiscal-year-2022-defense-budg/ https://www.defense.gov/News/Releases/Release/Article/263871...
14 3y ago
Well it has always been a cat and mouse game. Even with best intentions you will get someone discovering some sort of exploit, or some employee going rogue or forced or tricked into installing something. When ever we talked about these issues it brings me right back to the xbox 360 days and the hacking scene. It was amazing to see the back and forth between MS and the hackers and what each side would do to countermeasure the other. The one that impressed me the most was MS started making games about 8gb in length. DVD's only were only sold in 7.5gb size. Hackers learned that the games were just being padded with random useless data so learned to truncate the games and burn to 7.5gb discs again. MS learned to detect truncated games. Hackers then figured out how to flash certain DVD burners so that they would burn to the outer most area of the 7.5gb DVDs, an area that would typically not be used due to chance of increased errors burning in that area. So then you could burn a game all the way to the edge of the disc and then hackers developed a scanner to check for game errors as burning to the edge didn't work well so you would have to burn at slow speeds and really use high quality DVDs as cheap ones didn't work well. The back and forth that kept happening was so impressive. I guess my point is no matter what you try as long as millions of dollars is on the line people will find a way.
tacocataco 3y ago
How long till we break up these colluding market forces so there is some redundancy?
bradleyjg 3y ago
There’s not enough qualified people to take computer security seriously. The vast majority of “cybersecurity” professionals are capable only of insuring that boxes are checked. Of the small number of truly qualified people, many work as independent researchers or in small specialized consultancies because they are dispositionally incompatible with a giant enterprise. The remainder work in places like Google or Microsoft. If UnitedHealth Group by some miracle broke through its cultural barriers to hiring a bunch of poorly dressed 28 year olds with bad attitudes, paying each more than a group vice president makes, plus empowering the head bad attitude former hacker CISO to block corporate initiatives in the name of security, it still would be a zero sum game. We’d end up with a less secure android or windows.
ajiejsmmak 3y ago
People take it seriously and all it got us was a bunch of idiot cyber box-checkers and a lot of paperwork. The fundamental problem is pushing to digitize everything way too fast and being totally irresponsible with the data. You should have to pass a competence test before you integrate computerization of a lot of these kinds of processes, but obviously the tech lobby would not like that one bit because they only exist on account of selling their victims a sense of overconfidence.

15457345234 3y ago

> everyone starts to take computer security seriously Weren't the last big attacks literally carried out by hackers exploiting security software? As in, the solarwinds thing, which was carried out on systems which were 'textbook secure' ? If you want a secure system, my advice would be to fall back to using dumb hardware terminals, VT100 style. Anything more complicated than that will have a backdoor.

tempodox 3y ago
Fair enough, a no-bullshit discussion on how to actually achieve security should be part of the process.
- 15457345234 3y ago
  The issue is, actually having that discussion becomes very hard, because a lot of 'security consultants' basically rely on the commissions they get from selling that type of inherently-creating-a-single-point-of-compromise managementware. So all of the 'experts' you might draft in to give you helpful advice will be telling you exactly the opposite of what you should be doing, which is reducing your attack surface as much as possible; cutting down, not increasing, the number of apps installed. And don't get me started on MDMs, which are basically a rootkit that's only as benign as the guy sitting behind the operator panel.
faeriechangling 3y ago
I wouldn’t characterize solarwinds as “security software”, the product that got hit was classic up/down monitoring software.
jart 3y ago
Reuters said, "[t]he problems began last week after hackers gained access to Change Healthcare's information technology systems [...]" so it was probably because some airhead gave their login to the hacker over the phone. Social engineering accounts for 98% of all cyber-attacks. Highly intelligent people who are only accustomed to employing software don't understand this, because the only thing they're afraid of is their software getting exploited.
- rolandog 3y ago
  My money is on some un-upgraded backend/frontend stuff due to "compatibility" and/or lack of budget to hire people to keep things patched and up-to-date.
  - 15457345234 3y ago
    Blah, when it comes to a target that large, hackers will insert a contractor into the role who can secure the relevant credentials. This is another reason the remote-work scenario is such an issue - it's so trivial when large numbers of people are working remotely to gain access to secure systems.
- bradleyjg 3y ago
  Why are we shipping software that’s hard on the outside and soft on the inside? We know our customers have employees that will be socially engineered. Heck, let’s not be smug, “we” have employees that will be too.
  - TeMPOraL 3y ago
    > software that’s hard on the outside and soft on the inside So are tanks. And so are humans. Security is opposite to usefulness. If you harden your system thoroughly to the limit of possibility, it becomes a rock. Systems are made to do something, so some parts need to actually do that thing.
    - bradleyjg 3y ago
mikewarot 3y ago
>using dumb hardware terminals, VT100 style Those VT-100 terminals actually have Z80 CPUs in them, but even so, they connected to VAX or other computer systems, which are generally networked.

staplers 3y ago

Multi-trillions in defense spending and for what? Our country is crippled with ineptitude and hogtied by the billionaire plutocracy. The systems the masses depend on will crumble long before the ruling class notices. Look to our national elections as a grotesque reminder.

DinaCoder99 3y ago
Given how poorly our defense spending effects literally anything related to our security, I'd rather not discover what havoc our government might wreak on the internet.
Amezarak 3y ago
The US government as a whole already spends more on health care than it does on defense. 2022: 944 billion (Medicare), 805 billion (Medicaid). [1] We could add the VA health care system (approx 100 billion), CHIP (few tens of billions), ACA subsidies (tens of billions), other publicly owned medical services (???), and probably some more things we're forgetting. 753 billion requested by the WH in defense spending. [2] This probably does not encompass all defense spending period, but there's nothing else going to add many 100s of billions to even come close to the health care figure. The problem with the US medical system isn't that not enough dollars are being allocated to it. The US government as a whole (state and federal) is already spending as much per capita as many European countries. We just don't get as much for it. I think it's fair to say as you did that entire sectors of the US economy are being crippled by ineptitude, which I would say is institutional rather than personal. The problem is systemic and it's hard to see how it could ever be practically fixed. [1] https://www.cms.gov/data-research/statistics-trends-and-reports/national-health-expenditure-data/nhe-fact-sheet https://www.cms.gov/data-research/statistics-trends-and-repo... [2] https://www.defense.gov/News/Releases/Release/Article/2638711/the-department-of-defense-releases-the-presidents-fiscal-year-2022-defense-budg/ https://www.defense.gov/News/Releases/Release/Article/263871...

14 3y ago

Well it has always been a cat and mouse game. Even with best intentions you will get someone discovering some sort of exploit, or some employee going rogue or forced or tricked into installing something. When ever we talked about these issues it brings me right back to the xbox 360 days and the hacking scene. It was amazing to see the back and forth between MS and the hackers and what each side would do to countermeasure the other. The one that impressed me the most was MS started making games about 8gb in length. DVD's only were only sold in 7.5gb size. Hackers learned that the games were just being padded with random useless data so learned to truncate the games and burn to 7.5gb discs again. MS learned to detect truncated games. Hackers then figured out how to flash certain DVD burners so that they would burn to the outer most area of the 7.5gb DVDs, an area that would typically not be used due to chance of increased errors burning in that area. So then you could burn a game all the way to the edge of the disc and then hackers developed a scanner to check for game errors as burning to the edge didn't work well so you would have to burn at slow speeds and really use high quality DVDs as cheap ones didn't work well. The back and forth that kept happening was so impressive. I guess my point is no matter what you try as long as millions of dollars is on the line people will find a way.

tacocataco 3y ago

How long till we break up these colluding market forces so there is some redundancy?

bradleyjg 3y ago

There’s not enough qualified people to take computer security seriously. The vast majority of “cybersecurity” professionals are capable only of insuring that boxes are checked. Of the small number of truly qualified people, many work as independent researchers or in small specialized consultancies because they are dispositionally incompatible with a giant enterprise. The remainder work in places like Google or Microsoft. If UnitedHealth Group by some miracle broke through its cultural barriers to hiring a bunch of poorly dressed 28 year olds with bad attitudes, paying each more than a group vice president makes, plus empowering the head bad attitude former hacker CISO to block corporate initiatives in the name of security, it still would be a zero sum game. We’d end up with a less secure android or windows.

ajiejsmmak 3y ago

People take it seriously and all it got us was a bunch of idiot cyber box-checkers and a lot of paperwork. The fundamental problem is pushing to digitize everything way too fast and being totally irresponsible with the data. You should have to pass a competence test before you integrate computerization of a lot of these kinds of processes, but obviously the tech lobby would not like that one bit because they only exist on account of selling their victims a sense of overconfidence.