6 ms·

Soon enough anything that is even remotely a security threat (pretty much any non-trivial app) will require clearance and in office work. The North Korean hack

Soon enough anything that is even remotely a security threat (pretty much any non-trivial app) will require clearance and in office work. The North Korean hacks into several companies are an example of how bad it is now, add in some good deep fake technology and soon you will not be able to distinguish who is actually working for your company.

throw10920 2y ago
> Soon enough anything that is even remotely a security threat [...] will require clearance and in office work. I think this is one of those things that sucks but may be necessary. You need to trust the knowledge workers that make up your economy to not send your research to a hostile nation so they can take advantage of your R&D investments. And you need to know that your critical infrastructure (beyond Internet and trains, think about electricity and running water) isn't vulnerable to being slowly pwned and then shut down all at once in a catastrophic event that coincides with a forcible military reunification of one Asian country with another. Although the latter problem is less malice and more general incompetence in the cyber security realm. Can't solve that with a security clearance or RTO. Solar Winds anyone?
- mistrial9 2y ago
  > You need to trust the knowledge workers unfortunately among many circles, it is the opposite. More and more "zero trust" .. more logging and audit, more spot checks, more re-logins .. It is a culture clash, always-on networking has made it much worse, since security professionals have endless lists of problems they see.
  - WarOnPrivacy 2y ago
    > More and more "zero trust" .. more logging and audit, more spot checks, more re-logins Shades of HIPAA. It tries to tackle security and privacy of patient data but it winds up applying large corp requirements (inappropriately) to small practices. There seems to be little distinction of who the regs are being applied to. One upshot is that small practices have to dedicate resources to understand/audit/report/comply with requirements that don't apply to them. ex: Extensive audits of how a practice secures local patient data that doesn't exist - because it fully resides on remote provider platforms.
  - oivey 2y ago
    You cut off the part of the quote that says you can’t trust people by default, misrepresenting what who you quoted was saying.
- sandworm101 2y ago
  >> vulnerable to being slowly pwned and then shut down all at once in a catastrophic event A few years ago everyone thought that would happen to Ukraine, that Russian hackers would shut down everything from water delivery to weapon systems. The hackers almost certainly tried, yet the lights remained on. Imho we overestimate the power of "nation-state hackers" and underestimate the resilience of our systems.
  - alephnerd 2y ago
    Ukraine also had a significant amount of non-computerized legacy infra from the Soviet era which reduced the scope of IT/OT attacks. On the other hand, because of early mover advantage, a lot of utilities in the US computerized fairly early but the upfront cost of maintenance remained high.
  - djhn 2y ago
    Wasn’t the initial first day blitz overwhelming many border-adjacent units and military bases was largely due to pwned 4g/5g infra and having those troops accurate location?
  - singularity2001 2y ago
    my theory is that behind the scenes the Ukraine is a proxy Warzone for nation state hackers and while the support of weapons was limited the support in countering online attacks would be rather unlimited
- protomolecule 2y ago
  [flagged]
  - peutetre 2y ago
    [flagged]
    - protomolecule 2y ago
      If you seriously think it's possible, than you yourself should be worried a lot -- the last thing the West needs is even stronger China with its enormous industrial base and control of Siberian resources.
      - peutetre 2y ago
        It's already started. China sees Russia's annexation of Outer Manchuria as a great historical wrong: https://lansinginstitute.org/2024/02/16/chinas-global-triumph-impossible-without-some-parts-of-the-far-east-back/ https://lansinginstitute.org/2024/02/16/chinas-global-triump... China has reverted to using Chinese place names for cities and regions in the Far East. e.g. "Vladivostok" is now officially "Haishenwai": https://cepa.org/article/goodbye-vladivostok-hello-haishenwai/ https://cepa.org/article/goodbye-vladivostok-hello-haishenwa... https://asiatimes.com/2023/03/china-eyes-russias-far-east-resources-patriots-want-more/ https://asiatimes.com/2023/03/china-eyes-russias-far-east-re... Russia is in demographic decline. China simply has more people to throw at the problem, even amid it's own demographic decline: https://www.atlanticcouncil.org/content-series/russia-tomorrow/a-russia-without-russians-putins-disastrous-demographics/ https://www.atlanticcouncil.org/content-series/russia-tomorr... https://www.newsweek.com/russia-population-drop-2046-worst-case-scenario-1859384 https://www.newsweek.com/russia-population-drop-2046-worst-c... Killing off even more Russians in a pointless war of choice in Ukraine isn't helping matters.
        protomolecule 2y ago
        Be worried then
- RandomThoughts3 2y ago
  [flagged]
  - Spooky23 2y ago
    It’s very different than Japan. Japan is more like the US, capitalist where some companies are cozy with the government. China is a communist state, where the state or affiliated entity is an owner or partner in significant enterprises. Many industrial commodities have national security interests. Chinese intelligence entities have embedded engineers in a variety of sectors… a few years ago a guy got caught embedding turbine designs inside of nature photos from GE Vernova. Another recently got caught exfiltrating aviation trade secrets, including turbofan designs. This type of intelligence and technology transfer is no doubt helpful to Comac, the PLA controlled aircraft manufacturer.
    - RandomThoughts3 2y ago
      [flagged]
      - throw10920 2y ago
        [flagged]
        RandomThoughts3 2y ago
        [flagged]
        throw10920 2y ago
        [flagged]
        throw10920 2y ago
        And to be absolutely clear: it should be obvious, but I am not stating that CIA intervening in other counties' economies isn't bad - just that it is objectively difficult than IP theft of the kind the PRC engages in.
smitty1e 2y ago
...some ultra-short story fragment about AI & trust protocols so hoovering up all the resources that Usenet & text-only email make a comeback, as nothing more sophisticated functions any longer.
wruza 2y ago
How does it work in US, you just look at the guy and then he sends you his IBAN? Aren’t companies required to establish an employee’s origin by bureaucratic means? IDs, SSNs, notarized copies, work permit, etc? Why are North Korean guys even a problem, it feels like they shouldn’t be able to fake identification numbers and permits, unless something is fundamentally wrong with the country’s accounting.
- yread 2y ago
  they dont have iban in the US. That would be communism
  - jen20 2y ago
    What? Every US account I have can receive international transactions via an IBAN number. They just aren't used for domestic transactions - this is the same in the UK (where a sort code is used in place of a routing code, but has exactly the same purpose).
  - RandomThoughts3 2y ago
    They use Swift BIC and an account number at the branch because that’s already there and there is one thing American banks hate even more than communism it’s change and having to spend any kind of money to modernise.
- sudosysgen 2y ago
  Indeed there is such a thing, it's the I-9 document check and is required for all new employees. The problem is that identity theft is so ridiculously easily in the US that it's trivial for bad actors to just steal someone's identity. The solution is to fix identity theft.
  - jen20 2y ago
    This starts with the framing. One does not have their identity stolen. The counterparty is instead defrauded into believing something that is not true - and the problem must be made entirely theirs.
binary132 2y ago
Hiring and administrative machinery will therefore obviously be the target for an intelligent adversary, which we should presume we are facing.
- marcus0x62 2y ago
  I think anybody (especially a private employer, but really anyone) hiring somebody from an adversary country who thinks they can conduct an effective background investigation is fooling themselves. There's not really any avenue of investigation (other than vetting via your native intelligence service) that doesn't lead back to the foreign government, or an agency they control.
  - binary132 2y ago
    Nobody thought they were hiring people from North Korea, just saying.
    - marcus0x62 2y ago
      Which is orthogonal to the case of knowingly hiring someone from a place where you can't conduct an effective background check.
captainbland 2y ago
> in office work Doesn't this result in more over the shoulder opportunities by insider threat actors (i.e. spies) in conventional open office settings? Unclear how this meshes with outsourcing also.
duxup 2y ago
Long ago I worked at a company that had equipment sold to a US military contractor and we had to send someone onsite to fix it. You were instructed that anything you had in your vehicle when you got to the gate (in the middle of nowhere) might be confiscated. Show up with the rental car, keys, ID, and necessary equipment only. Nothing but you and your clothing would leave the site, yes it cost a laptop each visit (that we sent ahead). ID, car and keys stayed at the gate. Blindfolded while onsite until you got to the equipment, someone would take you to the bathroom. It was a lot, but I suspect some form of “all electronics dropped here” should be the SOP in a lot of places. It kinda horrifies me when I hear about congressional members upset about not being able to take their phones to some meetings and so on.

throw10920 2y ago

> Soon enough anything that is even remotely a security threat [...] will require clearance and in office work. I think this is one of those things that sucks but may be necessary. You need to trust the knowledge workers that make up your economy to not send your research to a hostile nation so they can take advantage of your R&D investments. And you need to know that your critical infrastructure (beyond Internet and trains, think about electricity and running water) isn't vulnerable to being slowly pwned and then shut down all at once in a catastrophic event that coincides with a forcible military reunification of one Asian country with another. Although the latter problem is less malice and more general incompetence in the cyber security realm. Can't solve that with a security clearance or RTO. Solar Winds anyone?

mistrial9 2y ago
> You need to trust the knowledge workers unfortunately among many circles, it is the opposite. More and more "zero trust" .. more logging and audit, more spot checks, more re-logins .. It is a culture clash, always-on networking has made it much worse, since security professionals have endless lists of problems they see.
- WarOnPrivacy 2y ago
  > More and more "zero trust" .. more logging and audit, more spot checks, more re-logins Shades of HIPAA. It tries to tackle security and privacy of patient data but it winds up applying large corp requirements (inappropriately) to small practices. There seems to be little distinction of who the regs are being applied to. One upshot is that small practices have to dedicate resources to understand/audit/report/comply with requirements that don't apply to them. ex: Extensive audits of how a practice secures local patient data that doesn't exist - because it fully resides on remote provider platforms.
- oivey 2y ago
  You cut off the part of the quote that says you can’t trust people by default, misrepresenting what who you quoted was saying.
sandworm101 2y ago
>> vulnerable to being slowly pwned and then shut down all at once in a catastrophic event A few years ago everyone thought that would happen to Ukraine, that Russian hackers would shut down everything from water delivery to weapon systems. The hackers almost certainly tried, yet the lights remained on. Imho we overestimate the power of "nation-state hackers" and underestimate the resilience of our systems.
- alephnerd 2y ago
  Ukraine also had a significant amount of non-computerized legacy infra from the Soviet era which reduced the scope of IT/OT attacks. On the other hand, because of early mover advantage, a lot of utilities in the US computerized fairly early but the upfront cost of maintenance remained high.
- djhn 2y ago
  Wasn’t the initial first day blitz overwhelming many border-adjacent units and military bases was largely due to pwned 4g/5g infra and having those troops accurate location?
- singularity2001 2y ago
  my theory is that behind the scenes the Ukraine is a proxy Warzone for nation state hackers and while the support of weapons was limited the support in countering online attacks would be rather unlimited
protomolecule 2y ago
[flagged]
- peutetre 2y ago
  [flagged]
  - protomolecule 2y ago
    If you seriously think it's possible, than you yourself should be worried a lot -- the last thing the West needs is even stronger China with its enormous industrial base and control of Siberian resources.
    - peutetre 2y ago
      It's already started. China sees Russia's annexation of Outer Manchuria as a great historical wrong: https://lansinginstitute.org/2024/02/16/chinas-global-triumph-impossible-without-some-parts-of-the-far-east-back/ https://lansinginstitute.org/2024/02/16/chinas-global-triump... China has reverted to using Chinese place names for cities and regions in the Far East. e.g. "Vladivostok" is now officially "Haishenwai": https://cepa.org/article/goodbye-vladivostok-hello-haishenwai/ https://cepa.org/article/goodbye-vladivostok-hello-haishenwa... https://asiatimes.com/2023/03/china-eyes-russias-far-east-resources-patriots-want-more/ https://asiatimes.com/2023/03/china-eyes-russias-far-east-re... Russia is in demographic decline. China simply has more people to throw at the problem, even amid it's own demographic decline: https://www.atlanticcouncil.org/content-series/russia-tomorrow/a-russia-without-russians-putins-disastrous-demographics/ https://www.atlanticcouncil.org/content-series/russia-tomorr... https://www.newsweek.com/russia-population-drop-2046-worst-case-scenario-1859384 https://www.newsweek.com/russia-population-drop-2046-worst-c... Killing off even more Russians in a pointless war of choice in Ukraine isn't helping matters.
      - protomolecule 2y ago
        Be worried then
RandomThoughts3 2y ago
[flagged]
- Spooky23 2y ago
  It’s very different than Japan. Japan is more like the US, capitalist where some companies are cozy with the government. China is a communist state, where the state or affiliated entity is an owner or partner in significant enterprises. Many industrial commodities have national security interests. Chinese intelligence entities have embedded engineers in a variety of sectors… a few years ago a guy got caught embedding turbine designs inside of nature photos from GE Vernova. Another recently got caught exfiltrating aviation trade secrets, including turbofan designs. This type of intelligence and technology transfer is no doubt helpful to Comac, the PLA controlled aircraft manufacturer.
  - RandomThoughts3 2y ago
    [flagged]
    - throw10920 2y ago
      [flagged]
      - RandomThoughts3 2y ago
        [flagged]
        throw10920 2y ago
        [flagged]
        throw10920 2y ago
        And to be absolutely clear: it should be obvious, but I am not stating that CIA intervening in other counties' economies isn't bad - just that it is objectively difficult than IP theft of the kind the PRC engages in.

smitty1e 2y ago

...some ultra-short story fragment about AI & trust protocols so hoovering up all the resources that Usenet & text-only email make a comeback, as nothing more sophisticated functions any longer.

wruza 2y ago

How does it work in US, you just look at the guy and then he sends you his IBAN? Aren’t companies required to establish an employee’s origin by bureaucratic means? IDs, SSNs, notarized copies, work permit, etc? Why are North Korean guys even a problem, it feels like they shouldn’t be able to fake identification numbers and permits, unless something is fundamentally wrong with the country’s accounting.

yread 2y ago
they dont have iban in the US. That would be communism
- jen20 2y ago
  What? Every US account I have can receive international transactions via an IBAN number. They just aren't used for domestic transactions - this is the same in the UK (where a sort code is used in place of a routing code, but has exactly the same purpose).
- RandomThoughts3 2y ago
  They use Swift BIC and an account number at the branch because that’s already there and there is one thing American banks hate even more than communism it’s change and having to spend any kind of money to modernise.
sudosysgen 2y ago
Indeed there is such a thing, it's the I-9 document check and is required for all new employees. The problem is that identity theft is so ridiculously easily in the US that it's trivial for bad actors to just steal someone's identity. The solution is to fix identity theft.
- jen20 2y ago
  This starts with the framing. One does not have their identity stolen. The counterparty is instead defrauded into believing something that is not true - and the problem must be made entirely theirs.

binary132 2y ago

Hiring and administrative machinery will therefore obviously be the target for an intelligent adversary, which we should presume we are facing.

marcus0x62 2y ago
I think anybody (especially a private employer, but really anyone) hiring somebody from an adversary country who thinks they can conduct an effective background investigation is fooling themselves. There's not really any avenue of investigation (other than vetting via your native intelligence service) that doesn't lead back to the foreign government, or an agency they control.
- binary132 2y ago
  Nobody thought they were hiring people from North Korea, just saying.
  - marcus0x62 2y ago
    Which is orthogonal to the case of knowingly hiring someone from a place where you can't conduct an effective background check.

captainbland 2y ago

> in office work Doesn't this result in more over the shoulder opportunities by insider threat actors (i.e. spies) in conventional open office settings? Unclear how this meshes with outsourcing also.

duxup 2y ago

Long ago I worked at a company that had equipment sold to a US military contractor and we had to send someone onsite to fix it. You were instructed that anything you had in your vehicle when you got to the gate (in the middle of nowhere) might be confiscated. Show up with the rental car, keys, ID, and necessary equipment only. Nothing but you and your clothing would leave the site, yes it cost a laptop each visit (that we sent ahead). ID, car and keys stayed at the gate. Blindfolded while onsite until you got to the equipment, someone would take you to the bathroom. It was a lot, but I suspect some form of “all electronics dropped here” should be the SOP in a lot of places. It kinda horrifies me when I hear about congressional members upset about not being able to take their phones to some meetings and so on.