3 ms·
Storing secrets in unsecured environments in plaintext is literally a vulnerability. One of the most famous examples can be seen in the NSA slide at the top of
by hiddencost 2y ago
Storing secrets in unsecured environments in plaintext is literally a vulnerability.
One of the most famous examples can be seen in the NSA slide at the top of this article:
https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
- notepad0x90 2y agothe security tools' storage system is always considered a secured environment.
- j4coh 2y agoWithout even having to secure it?
- throw_a_grenade 2y agoYes, but also No. So there's this thing called "Threat model" and it includes some assumptions about some moving parts of the infra, and it very often includes assertion that a particular environment (like IDS log, signing infra surrounding HSM etc.) is "secure" (they mean outside of the scope of that particular threat model). So it often gets papered over, and it takes some reflex to say "hey, how we will secure that other part". There needs to be some conciousnes about it, because it's not part of this model under discussuon, so not part of the agenda of this meeting... And it gets lost. That's how shit happens in compliance-oriented security.