3 ms·

Maybe I'm just hanging out in the wrong places but right now it feels like everyone is making stupid, stupid security mistakes all the time. If AI is the main b

Maybe I'm just hanging out in the wrong places but right now it feels like everyone is making stupid, stupid security mistakes all the time. If AI is the main buzzword, infosec is #2 right now.

deleted 3y ago
[deleted]
mandevil 3y ago
It feels to me more like it's the power of the comprehensive background scanning (I've seen it called 'internet background radiation') that is constantly taking place: anything you forget about, anything you misconfigure, anything you are slow to patch, that is going to be found and exploited by some tool someone built somewhere that is continually searching the entire internet for the same five mistakes.
- pixl97 3y ago
  And it's so easy to do... GET /file.name ERROR 404 [User: wtf is going on] Turns on directory index Sees /filé.name [Oh that's the problem] Forgets to turn directory index off
- gerdesj 3y ago
  Quite. My firm have a Nessus scanner and we point it at ourselves as well as our customers. There are also several checks on the monitoring system that will flag if something suddenly starts working. Background radiation is about right. Run up a honeypot VM with a web service on it and watch the logs with something like lnav. You soon get a feel for how fast the legitimate (and I use that term advisedly) crawlers like Google and that rock up along with the others. You will see a lot of hits from things with a Github link within their agent header - script kiddies or perhaps clever kiddies pretending to be script kiddies - more analysis needed. You will also see hits from agents claiming to be Google or Bing or Firefox on Commodore 64. Again, careful packet analysis, IP lists etc can be instructive ... if you can be arsed. Anyway. Humans cannot see network traffic. When you instruct your firewall to do something via its GUI or CLI you are merely providing instructions that may or may not actually do anything. Do feel free to actually test it. nmap, for example, is available for port testing and much, much more.
mparnisari 3y ago
> everyone is making stupid, stupid security mistakes all the time Newsflash: humans make mistakes all the time.
- rad_gruchalski 3y ago
  Only those who do nothing make no mistakes.
  - lazyasciiart 3y ago
    Sometimes that’s a mistake too.
- 01HNNWZ0MV43FF 3y ago
  Groundbreaking stuff. So security is fine, actually?
- rzzzt 3y ago
  Mice experience regret and are capable of learning from their mistakes: https://journals.plos.org/plosbiology/article?id=10.1371/journal.pbio.2005853 https://journals.plos.org/plosbiology/article?id=10.1371/jou...
coffeebeqn 3y ago
It’s the combinatorics. A small company might have a hundred micro services and some tens of third party dependencies and most of both only get touched or looked at when something goes wrong. Add in any code shipped to client machines and the various versions of everything and then add in basically everything related to IT and phishing and…
- pixl97 3y ago
  Software that gets used ships with insecure defaults, and software that ships hardened and totally locked down and must be configured for everyone's individual use case typically doesn't become successful.
- hathawsh 3y ago
  Exactly. Employee A adds a feature and adds security policies X and Y to prevent abuse. Employee B adds another feature and disables policy X because it conflicts with the new feature and policy Y is still in place. Employee C adds some functionality that conflicts with policy Y, but reasons that's OK because a comment says the feature is protected by both the X and Y policies. So policy Y gets disabled too. You can see why everyone would then start pointing fingers at each other. Hopefully, regular reviews and careful analysis prevent this kind of situation.
  - thephyber 3y ago
    The combinatorics works against “regular reviews and careful analysis”. The more the network grows, the more time+resources each review will take, but must be done at a regular interval, squeezing out other priorities. The best solution to keeping the combinatorics down is to have someone with authority who is happy to say “no” when a proposed new service doesn’t closely align with the org’s key goals.
  - Eisenstein 3y ago
    > Hopefully, regular reviews and careful analysis prevent this kind of situation. Without incentives it will just keep happening. We need to: 1. Incentivize emphasis on security by penalizing data breeches in a non-trivial way 2. Make orgs much more careful about the data they collect by mandating penalties which scale exponentially with the potential harm of the data which was released -- up to and including existential destruction
deleted 3y ago
[deleted]
skywhopper 3y ago
It’s at least partially because no one wants to employ actual operations specialists. Instead believing that developers and security response folks are sufficient. But good, sufficiently staffed ops teams know how to build real defense in depth across the stack, don’t just blindly trust automated scanners or installers, and proactively improve security iteratively over time.
hn_throwaway_99 3y ago
It's a technology problem, not a people problem. We have simply made technology where it is too easy to eventually make a simple mistake. For one obvious, simple example, most tech is optimized for "Make it easy to access all data from anywhere" as opposed to "require affirmative consent for connections to all new locations". It is surprisingly difficult to lockdown most systems, whether they be laptops or server networks, with that easy rule. Just look at folks who use Little Snitch - it can be difficult to use this effectively because so many apps need to talk to so many different servers that it can just be exhausting attempting to determine if a new connection is malicious or not. Similarly, look at some recommended settings for a "secure" Content Security Policy on the web. There are a boatload of different options that are recommended to be set, because the original defaults (e.g. "Sure, you can load me in an iframe of any other site!") are so insecure. As a consequence of this, it's very difficult for any (a) organization that can't afford top-notch security folks or (b) organizations that are so large, with a potentially huge history of acquisitions over time, with a giant surface area where all you need is one "chink in the armor", to prevent breaches.
- SloopJon 3y ago
  This is every bit as much a people problem as a technology problem. When I read the headline, I didn't even understand what there possibly was to breach at OWASP. > OWASP collected resumes as part of the early membership process, whereby members were required in the 2006 to 2014 era to show a connection to the OWASP community. OWASP no longer collects resumes as part of the membership process. Why did OWASP retain this information ten years after they stopped the practice?
  - Eisenstein 3y ago
    Probably because no one made the decision to delete it, and the person responsible for the system that it was on wasn't going to delete data without a strict order to do it. I think it is more of an 'organizational' problem, in that organizations don't have data retention and deletion policies.
overstay8930 3y ago
there’s so many infosec people who barely know how to use a computer in the corporate world
- MattPalmer1086 3y ago
  Also a lot of devs who think if they can't see how to exploit something, nobody else will be able to. Honestly, the arguments I've had with people claiming that their SQL injection isn't a problem ("it's in the middle of a clause" was a good one).

Maybe I'm just hanging out in the wrong places but right now it feels like everyone is making stupid, stupid security mistakes all the time. If AI is the main buzzword, infosec is #2 right now.

deleted 3y ago

[deleted]

mandevil 3y ago

It feels to me more like it's the power of the comprehensive background scanning (I've seen it called 'internet background radiation') that is constantly taking place: anything you forget about, anything you misconfigure, anything you are slow to patch, that is going to be found and exploited by some tool someone built somewhere that is continually searching the entire internet for the same five mistakes.

pixl97 3y ago
And it's so easy to do... GET /file.name ERROR 404 [User: wtf is going on] Turns on directory index Sees /filé.name [Oh that's the problem] Forgets to turn directory index off
gerdesj 3y ago
Quite. My firm have a Nessus scanner and we point it at ourselves as well as our customers. There are also several checks on the monitoring system that will flag if something suddenly starts working. Background radiation is about right. Run up a honeypot VM with a web service on it and watch the logs with something like lnav. You soon get a feel for how fast the legitimate (and I use that term advisedly) crawlers like Google and that rock up along with the others. You will see a lot of hits from things with a Github link within their agent header - script kiddies or perhaps clever kiddies pretending to be script kiddies - more analysis needed. You will also see hits from agents claiming to be Google or Bing or Firefox on Commodore 64. Again, careful packet analysis, IP lists etc can be instructive ... if you can be arsed. Anyway. Humans cannot see network traffic. When you instruct your firewall to do something via its GUI or CLI you are merely providing instructions that may or may not actually do anything. Do feel free to actually test it. nmap, for example, is available for port testing and much, much more.

mparnisari 3y ago

> everyone is making stupid, stupid security mistakes all the time Newsflash: humans make mistakes all the time.

rad_gruchalski 3y ago
Only those who do nothing make no mistakes.
- lazyasciiart 3y ago
  Sometimes that’s a mistake too.
01HNNWZ0MV43FF 3y ago
Groundbreaking stuff. So security is fine, actually?
rzzzt 3y ago
Mice experience regret and are capable of learning from their mistakes: https://journals.plos.org/plosbiology/article?id=10.1371/journal.pbio.2005853 https://journals.plos.org/plosbiology/article?id=10.1371/jou...

coffeebeqn 3y ago

It’s the combinatorics. A small company might have a hundred micro services and some tens of third party dependencies and most of both only get touched or looked at when something goes wrong. Add in any code shipped to client machines and the various versions of everything and then add in basically everything related to IT and phishing and…

pixl97 3y ago
Software that gets used ships with insecure defaults, and software that ships hardened and totally locked down and must be configured for everyone's individual use case typically doesn't become successful.
hathawsh 3y ago
Exactly. Employee A adds a feature and adds security policies X and Y to prevent abuse. Employee B adds another feature and disables policy X because it conflicts with the new feature and policy Y is still in place. Employee C adds some functionality that conflicts with policy Y, but reasons that's OK because a comment says the feature is protected by both the X and Y policies. So policy Y gets disabled too. You can see why everyone would then start pointing fingers at each other. Hopefully, regular reviews and careful analysis prevent this kind of situation.
- thephyber 3y ago
  The combinatorics works against “regular reviews and careful analysis”. The more the network grows, the more time+resources each review will take, but must be done at a regular interval, squeezing out other priorities. The best solution to keeping the combinatorics down is to have someone with authority who is happy to say “no” when a proposed new service doesn’t closely align with the org’s key goals.
- Eisenstein 3y ago
  > Hopefully, regular reviews and careful analysis prevent this kind of situation. Without incentives it will just keep happening. We need to: 1. Incentivize emphasis on security by penalizing data breeches in a non-trivial way 2. Make orgs much more careful about the data they collect by mandating penalties which scale exponentially with the potential harm of the data which was released -- up to and including existential destruction

deleted 3y ago

[deleted]

skywhopper 3y ago

It’s at least partially because no one wants to employ actual operations specialists. Instead believing that developers and security response folks are sufficient. But good, sufficiently staffed ops teams know how to build real defense in depth across the stack, don’t just blindly trust automated scanners or installers, and proactively improve security iteratively over time.

hn_throwaway_99 3y ago

It's a technology problem, not a people problem. We have simply made technology where it is too easy to eventually make a simple mistake. For one obvious, simple example, most tech is optimized for "Make it easy to access all data from anywhere" as opposed to "require affirmative consent for connections to all new locations". It is surprisingly difficult to lockdown most systems, whether they be laptops or server networks, with that easy rule. Just look at folks who use Little Snitch - it can be difficult to use this effectively because so many apps need to talk to so many different servers that it can just be exhausting attempting to determine if a new connection is malicious or not. Similarly, look at some recommended settings for a "secure" Content Security Policy on the web. There are a boatload of different options that are recommended to be set, because the original defaults (e.g. "Sure, you can load me in an iframe of any other site!") are so insecure. As a consequence of this, it's very difficult for any (a) organization that can't afford top-notch security folks or (b) organizations that are so large, with a potentially huge history of acquisitions over time, with a giant surface area where all you need is one "chink in the armor", to prevent breaches.

SloopJon 3y ago
This is every bit as much a people problem as a technology problem. When I read the headline, I didn't even understand what there possibly was to breach at OWASP. > OWASP collected resumes as part of the early membership process, whereby members were required in the 2006 to 2014 era to show a connection to the OWASP community. OWASP no longer collects resumes as part of the membership process. Why did OWASP retain this information ten years after they stopped the practice?
- Eisenstein 3y ago
  Probably because no one made the decision to delete it, and the person responsible for the system that it was on wasn't going to delete data without a strict order to do it. I think it is more of an 'organizational' problem, in that organizations don't have data retention and deletion policies.

overstay8930 3y ago

there’s so many infosec people who barely know how to use a computer in the corporate world

MattPalmer1086 3y ago
Also a lot of devs who think if they can't see how to exploit something, nobody else will be able to. Honestly, the arguments I've had with people claiming that their SQL injection isn't a problem ("it's in the middle of a clause" was a good one).