3 ms·

Nice they are doing their job and glad they exist. But how to fix ? Most US Gov agencies are underfunded, it is either beef up security or provide services.

by jmclnx 2y ago

Nice they are doing their job and glad they exist. But how to fix ? Most US Gov agencies are underfunded, it is either beef up security or provide services. Really a tough choice, and the outlook looks like they may lose even more funding.

akira2501 2y ago
Lesson learned: The assessed organization had insufficient controls to prevent and detect malicious activity. Lesson learned: The organization did not effectively or efficiently collect, retain, and analyze logs. Lesson learned: Bureaucratic processes and decentralized teams hindered the organization’s network defenders. Lesson learned: A “known-bad” detection approach hampered detection of alternate TTPs. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-193a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...
- doe_eyes 2y ago
  The problem with such "lessons learned" is that they are usually not lessons learned - I bet there were numerous people within the organization who knew about these issues before the test. The actual issue is probably that these people are (a) ineffectual at communicating and prioritizing concerns clearly; or (b) good at communicating, but are not being listened to; or (c) they are listened to, but the organization has no practical means to fix this - no money, unable to recruit talent, etc. Most techies often assume (b), but (a) is at least as common. The last issue - (c) - might be superficially true, although it's usually not correct in a deeper sense: there is plenty of discretionary and wasteful spending in any sufficiently large bureaucracy. Central resource allocation is just a hard problem. Anyway, my point is that the problems that need fixing are almost never just technical. Recommendations such as "implement sufficient controls to detect malicious activity" seldom get to the root cause. They are still useful in temporarily overcoming organizational obstacles, but it usually doesn't last.
deleted 2y ago
[deleted]
Rinzler89 2y ago
>Most US Gov agencies are underfunded Doesn't the US outspend in terms of dollars almost every single developed country on the planet at absolutely everything, even in per capita statistics, from military, police to education and healthcare? How could it be underfunded?
- lazide 2y ago
  The first thing you learn in government is that you’re always underfunded. If you aren’t, your budget will go to someone who is.
- throwway120385 2y ago
  The US is really really big. People way underestimate how huge it is in terms of land area. You could fit Europe inside the US. So the reason Germany or France underspend the US has more to do with the area they have to cover and the number of people they have in their borders.
  - dmix 2y ago
    > even in per capita statistics
    - tossandthrow 2y ago
      The argument is density. Things tend to be cheaper per capita, when density is high. I don't buy it thought. I think the reason why the spend is less in Europe is due to higher salary equality - good people take job in government because the salary is only 50% higher in private sector (for tech, even less for other areas).
      - vidarh 2y ago
        There are only a couple of US states less dense than e.g. Norway, and even in those states the vast majority of the population live in small, higher density areas. The areas where the vast majority of Americans actually live are fairly high density. Some cost might come down to density, but not much.
treflop 2y ago
Private companies get breached often too (see AT&T). Pretty much everyone gets breached. The only ones I don't think get breached deep are the really big software engineering companies where most of the company are also software engineers... like Google. Software is too complex to be secure without a massive team IMO.
- lazide 2y ago
  Eh, a massive team makes its own major issues. See the many Google leaks over the years. Assuming software can be secure (and hence not doing proper defense in depth, limiting the types and nature of information processed, etc). is the bigger issue IMO.
- tjohns 2y ago
  > Software is too complex to be secure without a massive team IMO. We could do better as an industry though. Modern operating system design makes it far too easy to shoot yourself in the foot. Imagine a world where all we all use memory-safe/null-safe/type-safe languages, applications and data are strictly sandboxed, access to data is only granted using capabilities-based security, application-level security patches are automatically applied by the OS, data was always encrypted while at rest and while in transit, and passwords are completely replaced with passkeys / smartcards (for users) and X.509 certificates (for servers). While this isn't a panacea, it would solve a great number of the most common security vulnerabilities. Each of these pieces exist individually. There's no reason why we can't have all of these things today, other than support for legacy applications and retraining engineers. However, it's nearly impossible to get away from legacy software needs. But if you want low hanging fruit... stop writing C/C++, and get rid of passwords. These are the biggest flaws in the stack.
  - infamouscow 2y ago
    There is no incentive for the industry to do better. As for government penalties being an incentive: If it was popular amongst the voters to hold corporations seriously responsible, you would see politicians campaign on it and win. It's not nearly as popular as virtually anything else based on empirical data. Another way to say this is if 80% of all voters, regardless of party prioritized this as the #1, #2, and #3 issue, politicians would pass laws. It makes the politician look good and solidifies their reelection. Likewise, politicians that vote against those laws would almost certainly not be reelected.
banish-m4 2y ago
Standardization by centralized administration, reduction of rogue external and DIY options, concentrating efforts on delivering managed services based on a common and repeatable platform, strict change control, clear training enumerating what is and what is not allowed, and a security team that actually digs in to make cross-cutting concerns more audited automatically, practical recommendations, least privilege continuously ratcheted down, and advise on new features and new projects.

by jmclnx 2y ago

akira2501 2y ago

Lesson learned: The assessed organization had insufficient controls to prevent and detect malicious activity. Lesson learned: The organization did not effectively or efficiently collect, retain, and analyze logs. Lesson learned: Bureaucratic processes and decentralized teams hindered the organization’s network defenders. Lesson learned: A “known-bad” detection approach hampered detection of alternate TTPs. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-193a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...

doe_eyes 2y ago
The problem with such "lessons learned" is that they are usually not lessons learned - I bet there were numerous people within the organization who knew about these issues before the test. The actual issue is probably that these people are (a) ineffectual at communicating and prioritizing concerns clearly; or (b) good at communicating, but are not being listened to; or (c) they are listened to, but the organization has no practical means to fix this - no money, unable to recruit talent, etc. Most techies often assume (b), but (a) is at least as common. The last issue - (c) - might be superficially true, although it's usually not correct in a deeper sense: there is plenty of discretionary and wasteful spending in any sufficiently large bureaucracy. Central resource allocation is just a hard problem. Anyway, my point is that the problems that need fixing are almost never just technical. Recommendations such as "implement sufficient controls to detect malicious activity" seldom get to the root cause. They are still useful in temporarily overcoming organizational obstacles, but it usually doesn't last.

deleted 2y ago

[deleted]

Rinzler89 2y ago

>Most US Gov agencies are underfunded Doesn't the US outspend in terms of dollars almost every single developed country on the planet at absolutely everything, even in per capita statistics, from military, police to education and healthcare? How could it be underfunded?

lazide 2y ago
The first thing you learn in government is that you’re always underfunded. If you aren’t, your budget will go to someone who is.
throwway120385 2y ago
The US is really really big. People way underestimate how huge it is in terms of land area. You could fit Europe inside the US. So the reason Germany or France underspend the US has more to do with the area they have to cover and the number of people they have in their borders.
- dmix 2y ago
  > even in per capita statistics
  - tossandthrow 2y ago
    The argument is density. Things tend to be cheaper per capita, when density is high. I don't buy it thought. I think the reason why the spend is less in Europe is due to higher salary equality - good people take job in government because the salary is only 50% higher in private sector (for tech, even less for other areas).
    - vidarh 2y ago
      There are only a couple of US states less dense than e.g. Norway, and even in those states the vast majority of the population live in small, higher density areas. The areas where the vast majority of Americans actually live are fairly high density. Some cost might come down to density, but not much.

treflop 2y ago

Private companies get breached often too (see AT&T). Pretty much everyone gets breached. The only ones I don't think get breached deep are the really big software engineering companies where most of the company are also software engineers... like Google. Software is too complex to be secure without a massive team IMO.

lazide 2y ago
Eh, a massive team makes its own major issues. See the many Google leaks over the years. Assuming software can be secure (and hence not doing proper defense in depth, limiting the types and nature of information processed, etc). is the bigger issue IMO.
tjohns 2y ago
> Software is too complex to be secure without a massive team IMO. We could do better as an industry though. Modern operating system design makes it far too easy to shoot yourself in the foot. Imagine a world where all we all use memory-safe/null-safe/type-safe languages, applications and data are strictly sandboxed, access to data is only granted using capabilities-based security, application-level security patches are automatically applied by the OS, data was always encrypted while at rest and while in transit, and passwords are completely replaced with passkeys / smartcards (for users) and X.509 certificates (for servers). While this isn't a panacea, it would solve a great number of the most common security vulnerabilities. Each of these pieces exist individually. There's no reason why we can't have all of these things today, other than support for legacy applications and retraining engineers. However, it's nearly impossible to get away from legacy software needs. But if you want low hanging fruit... stop writing C/C++, and get rid of passwords. These are the biggest flaws in the stack.
- infamouscow 2y ago
  There is no incentive for the industry to do better. As for government penalties being an incentive: If it was popular amongst the voters to hold corporations seriously responsible, you would see politicians campaign on it and win. It's not nearly as popular as virtually anything else based on empirical data. Another way to say this is if 80% of all voters, regardless of party prioritized this as the #1, #2, and #3 issue, politicians would pass laws. It makes the politician look good and solidifies their reelection. Likewise, politicians that vote against those laws would almost certainly not be reelected.

banish-m4 2y ago

Standardization by centralized administration, reduction of rogue external and DIY options, concentrating efforts on delivering managed services based on a common and repeatable platform, strict change control, clear training enumerating what is and what is not allowed, and a security team that actually digs in to make cross-cutting concerns more audited automatically, practical recommendations, least privilege continuously ratcheted down, and advise on new features and new projects.