4 ms·

My point was, why a display at a check in counter needs to run EDR software to begin with? Why can't it run a locked down, slimmed version of Windows in an isol

My point was, why a display at a check in counter needs to run EDR software to begin with? Why can't it run a locked down, slimmed version of Windows in an isolated network that has very low potential to get malware on it? I know why, because there is, probably, a regulation that says that if you run an airline company, you need to have malware protection on all machines. I bet, some IT guy even tried to question the need to run EDR on a non-mission-critical machine, but he was stopped by a wall of "it is what it is".

0xBDB 2y ago
>My point was, why a display at a check in counter needs to run EDR software to begin with? Because the thermostat on a fish tank has been used as a critical entry point into a casino network[1], and the point of EDR is not just to prevent that sort of thing if possible but also provide the telemetry into a SIEM for incident responders to know that it has happened after the fact and get the adversary out. So there is value in running it anywhere it can run. I've seen a lot of contempt on HN threads today for compliance regulations and insurance demands that require things like EDR be installed where possible. As a Red Teamer I used to share that contempt for the non-technical types, but I don't now. It's true compliance is not security, but also true that Chesterton's Fence should apply here: just because you shouldn't be checking the box blindly doesn't mean you shouldn't be either checking it or documenting why not. The people who created the box were (probably) not actually idiots. It's there because somebody else had a very bad day. 1. https://www.washingtonpost.com/news/innovations/wp/2017/07/21/how-a-fish-tank-helped-hack-a-casino/ https://www.washingtonpost.com/news/innovations/wp/2017/07/2...
passwordoops 2y ago
"I know why, because there is, probably, a regulation" Instead of assuming a regulation and writing a blog about it, do the research and find out. To quote the irreplaceable Benny Hill, "You mustn't assume, because it will make an ass out of you and me." Also, and more important, why default to regulation and not airline directors pushing ill-advised modernization strategies pushed by M$?
- ses1984 2y ago
  I've done the research. It’s called first hand experience. I was the guy making the arguments, that controls we already have in place obviate the need for edr everywhere, but I was told it doesn’t matter, gotta check the box.
  - passwordoops 2y ago
    Awesome. Is the box there because of government regulation or someone in corporate deciding it's necessary?
    - betaby 2y ago
      Corporation and consultants mostly, judging from my experience. If asked about precise law or regulation they just wave hands.
    - ses1984 2y ago
      In my case it was a pci-dss (payment card industry data security standard) audit.
      - moomin 2y ago
        The thing is, you read regulations, and they pretty much always tell you to do something, but it’s always heavily principle based. Companies are left with extraordinary leeway as to how these regulations are actually implemented.
        ses1984 2y ago
        You’re right, which I also used in my argument, but I was shot down by our own people, because their success metrics were based on passing the audit with the least amount of fuss. We kept our other controls, we just added edr as well, because just having it appeased auditors. If you try to explain to an auditor your other controls, it could change a part of the audit from five minutes to multiple days. We don’t use crowdstrike, but this was years ago.
chrisjj 2y ago
Because isolating the display and every machine to which it is necessarily connected obstructs monitoring and greatly increases the cost and delay of fixes if something should go wrong. Also I doubt any slimmed version of Windows is sufficiently malware proof without added EPS.
hug 2y ago
Low potential is not no potential, and most everyone is looking for swiss-cheese defense when it comes to these devices. In the case of a display at a check-in counter: - The display needs to be on a network, because it needs to collect information from elsewhere to display it. - It's on a network, so it needs to be kept updated, because a compromised host elsewhere on the same network will be able to compromise it, and anyway the display vendor won't support you if your product is nine versions behind current. - Since it needs updates for various components, it almost certainly needs some amount of outbound internet access, and it's also vulnerable to supply-chain attacks from those updates. - Since it is on a network, and has internet access, it needs to be running some kind of EDR or feed for a SIEM, because it is compromisable and the last thing you want is an unmonitored compromised host on your internal network talking back to C2. Anything that can be used for lateral movement will be used for lateral movement, and if we can get logs from it we want logs from it. A cross-platform EDR solution is perfect for these scenarios.
- chrisjj 2y ago
  Agreed. Re: "- It's on a network, so it needs to be kept updated, because a compromised host elsewhere on the same network will be able to compromise it" the suggested solution was "an isolated network".0 The problem there is the operator would have to use SD cards to update the adverts... :)

0xBDB 2y ago

>My point was, why a display at a check in counter needs to run EDR software to begin with? Because the thermostat on a fish tank has been used as a critical entry point into a casino network[1], and the point of EDR is not just to prevent that sort of thing if possible but also provide the telemetry into a SIEM for incident responders to know that it has happened after the fact and get the adversary out. So there is value in running it anywhere it can run. I've seen a lot of contempt on HN threads today for compliance regulations and insurance demands that require things like EDR be installed where possible. As a Red Teamer I used to share that contempt for the non-technical types, but I don't now. It's true compliance is not security, but also true that Chesterton's Fence should apply here: just because you shouldn't be checking the box blindly doesn't mean you shouldn't be either checking it or documenting why not. The people who created the box were (probably) not actually idiots. It's there because somebody else had a very bad day. 1. https://www.washingtonpost.com/news/innovations/wp/2017/07/21/how-a-fish-tank-helped-hack-a-casino/ https://www.washingtonpost.com/news/innovations/wp/2017/07/2...

passwordoops 2y ago

"I know why, because there is, probably, a regulation" Instead of assuming a regulation and writing a blog about it, do the research and find out. To quote the irreplaceable Benny Hill, "You mustn't assume, because it will make an ass out of you and me." Also, and more important, why default to regulation and not airline directors pushing ill-advised modernization strategies pushed by M$?

ses1984 2y ago
I've done the research. It’s called first hand experience. I was the guy making the arguments, that controls we already have in place obviate the need for edr everywhere, but I was told it doesn’t matter, gotta check the box.
- passwordoops 2y ago
  Awesome. Is the box there because of government regulation or someone in corporate deciding it's necessary?
  - betaby 2y ago
    Corporation and consultants mostly, judging from my experience. If asked about precise law or regulation they just wave hands.
  - ses1984 2y ago
    In my case it was a pci-dss (payment card industry data security standard) audit.
    - moomin 2y ago
      The thing is, you read regulations, and they pretty much always tell you to do something, but it’s always heavily principle based. Companies are left with extraordinary leeway as to how these regulations are actually implemented.
      - ses1984 2y ago
        You’re right, which I also used in my argument, but I was shot down by our own people, because their success metrics were based on passing the audit with the least amount of fuss. We kept our other controls, we just added edr as well, because just having it appeased auditors. If you try to explain to an auditor your other controls, it could change a part of the audit from five minutes to multiple days. We don’t use crowdstrike, but this was years ago.

chrisjj 2y ago

Because isolating the display and every machine to which it is necessarily connected obstructs monitoring and greatly increases the cost and delay of fixes if something should go wrong. Also I doubt any slimmed version of Windows is sufficiently malware proof without added EPS.

hug 2y ago

Low potential is not no potential, and most everyone is looking for swiss-cheese defense when it comes to these devices. In the case of a display at a check-in counter: - The display needs to be on a network, because it needs to collect information from elsewhere to display it. - It's on a network, so it needs to be kept updated, because a compromised host elsewhere on the same network will be able to compromise it, and anyway the display vendor won't support you if your product is nine versions behind current. - Since it needs updates for various components, it almost certainly needs some amount of outbound internet access, and it's also vulnerable to supply-chain attacks from those updates. - Since it is on a network, and has internet access, it needs to be running some kind of EDR or feed for a SIEM, because it is compromisable and the last thing you want is an unmonitored compromised host on your internal network talking back to C2. Anything that can be used for lateral movement will be used for lateral movement, and if we can get logs from it we want logs from it. A cross-platform EDR solution is perfect for these scenarios.

chrisjj 2y ago
Agreed. Re: "- It's on a network, so it needs to be kept updated, because a compromised host elsewhere on the same network will be able to compromise it" the suggested solution was "an isolated network".0 The problem there is the operator would have to use SD cards to update the adverts... :)