7 ms·

> CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's intere

> CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN.

jauntywundrkind 1y ago
Oh CISA... What a pity that CISA has been purged down of effective useful people and turned into another sad selected-for-political-compliance-only force. Arizona recently got attacked from Iranian hackers & didn't even bother trying to get help from CISA. https://archive.is/2025.07.19-143305/https://www.azcentral.com/story/news/politics/elections/2025/07/19/iran-hacked-arizona-secretary-of-state-election-candidate-website/85265280007/ https://archive.is/2025.07.19-143305/https://www.azcentral.c... CISA is so so vital. Investigating incredibly wide ranging attacks like this, or the Salt Typhoon attack are vital for this nation. But the show is being run by a bunch of people who value political dogma far above anything else. https://www.techdirt.com/tag/cisa/ https://www.techdirt.com/tag/cisa/
- blurbleblurble 1y ago
  It almost seems like the goal is to hurt people
  - sneak 1y ago
    [flagged]
    - rachofsunshine 1y ago
      There's some truth to this in that all organizations ultimately have their own perpetuation as a goal...but this is also a little like saying "well, there are a lot of complicated macroeconomic drivers of theft" while you're stealing somebody's purse. The harms here are not the result of some broad faceless force so distributed and ethereal as to avoid accountability. The people performing them know exactly what they are doing. They're choosing to do it, when no systemic factor forces them to. If they wanted to not harm people, they could do so at zero or even negative harm to themselves. Systems-level thinking is a useful tool, but it can make you miss the trees for the forest when a single concrete human being in front of you is just a bad person.
    - lyu07282 1y ago
      [flagged]
      - strogonoff 1y ago
        Sometimes it looks as if it matters more whether people are good and work in good faith rather than what a particular system is. However, the more extreme the system (be it anarchocapitalism or communism), the higher the requirement to the goodness of people. As is, in current societes I find that the ambient chaos of general democratic capitalism counteracts the threat of small minority making wrong decisions (Mao’s famine, etc.) while strategic regulations help curb bad actors abusing the system (like selling people poison or dumping toxic waste into rivers). Both are needed, and I usually suspect that people who call for one extreme or the other either have an agenda or have not thought it through. (In the West it is often pro-capitalist tendencies, though I encountered both.)
        lyu07282 1y ago
        > democratic capitalism I don't think I have anything in response to that one.
        strogonoff 1y ago
        I was actually on your side in this, oh well!
        lyu07282 1y ago
        Only liberals could describe our system as "democratic capitalism" with a straight face, its absurd. I'm on the left, I'm not a liberal, so no, we are definitely not on the same side. I believe our intolerable levels of inequality and disparity is caused by systemic issues not some "bad actors".
        strogonoff 1y ago
        OK.
- aurelien 1y ago
  So true, they make bullshit that affect security also on some security tools analyser … do not worry NSA everything is fine, you are not at risk against worms xD
Arainach 1y ago
Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed. So you don't do that. You use zero trust and don't care that things are exposed to the internet. Working from anywhere (remote sites, home, your phone) is a huge benefit. Organizations want to control their data entirely while still wanting their organization to be able to access it.
- anonymars 1y ago
  Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!
  - zamadatix 1y ago
    In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).
    - anonymars 1y ago
      So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?
      - hug 1y ago
        Yes, that's zero trust in a nutshell: A VPN that does a tunnel per TCP connection instead of one tunnel for all TCP connections. The other salient point is that all connections are established outbound through a broker, and importantly this is the case from both sides: The appliance at the terminating end of the tunnel establishes reverse tunnels to the broker for the connections, so it's never "exposed to the internet". The broker can then push to your SIEM or whatever so you can have your SOC log jockeys harass your employees for accidentally leaving NordVPN on after watching international sports. There are actual benefits: You can do things like allow logins to system A from anywhere, but system B only from your home country, you can do JIT network access requests, etc... but mostly it's vendor marketing to get you to spend too much money.
cptskippy 1y ago
> It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. Once upon a time Microsoft marketed it as, and a lot of Orgs adopted SharePoint as their Intranet. With SharePoint 2019 being sunset, a lot of Orgs are scrambling to implement replacements.
p_ing 1y ago
Hosting internal services be they SharePoint or Exchange behind a [pre-auth] reverse proxy isn't that unusual.
technion 1y ago
The product was explicitly promoted as being useful to run public websites. Before cloud took off we had Microsoft sales people in our office announcing the death of Wordpress with the latest Sharepoint release. That position may be old, but plenty of orgs live in the past.
- xcrunner529 1y ago
  My former boss bought that hook,line, and sinker and that’s why I was fixing the legacy cms environment today.
nickitolas 1y ago
I would assume some orgs made it public facing for covid and it remained like that
gomicrosoft 1y ago
That’s the whole thing with Azure; it blurs the line between on-prem and cloud “because you can.” I never remember thinking years ago how nice it would be to have all of our private docs that we only need to access on our private network accessible to the public. I just wasn’t thinking outside the box enough.
- cindyllm 1y ago
  [dead]
cirgue 1y ago
The answer is contractors and consultants. State agencies routinely work with third parties that need to be able to share files. Obviously this isn’t universal but it isn’t uncommon.
devjab 1y ago
> It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN. It likely will be entirely contained, at least in theory. Because is your IT and OT isolated? They should be, but man could I tell you something about the energy and public sectors... Let's just say, that if you're in an organisation with any sort of OT, then you may as well assume that everything you have is facing the internet in some way. I suspect it's frankly like this in any sort of enterprise organisation getting worse the more the org views IT purely as a cost center. This is why we don't just rely on things like VPNs. Everything we have uses port security (mac-adresses) at a much more ganular level than the VPN does. At least for the parts of our systems landscape where this is possible. With something like SharePoint it's hard to allow specific devices because it's usually something everyone should have some sort of access to. Then you have all the organisations where SharePoint also has some sort of non-VPN access because some CEO level wanted it at one point since they can't be bothered to bring a work PC to their Holiday home.

jauntywundrkind 1y ago

Oh CISA... What a pity that CISA has been purged down of effective useful people and turned into another sad selected-for-political-compliance-only force. Arizona recently got attacked from Iranian hackers & didn't even bother trying to get help from CISA. https://archive.is/2025.07.19-143305/https://www.azcentral.com/story/news/politics/elections/2025/07/19/iran-hacked-arizona-secretary-of-state-election-candidate-website/85265280007/ https://archive.is/2025.07.19-143305/https://www.azcentral.c... CISA is so so vital. Investigating incredibly wide ranging attacks like this, or the Salt Typhoon attack are vital for this nation. But the show is being run by a bunch of people who value political dogma far above anything else. https://www.techdirt.com/tag/cisa/ https://www.techdirt.com/tag/cisa/

blurbleblurble 1y ago
It almost seems like the goal is to hurt people
- sneak 1y ago
  [flagged]
  - rachofsunshine 1y ago
    There's some truth to this in that all organizations ultimately have their own perpetuation as a goal...but this is also a little like saying "well, there are a lot of complicated macroeconomic drivers of theft" while you're stealing somebody's purse. The harms here are not the result of some broad faceless force so distributed and ethereal as to avoid accountability. The people performing them know exactly what they are doing. They're choosing to do it, when no systemic factor forces them to. If they wanted to not harm people, they could do so at zero or even negative harm to themselves. Systems-level thinking is a useful tool, but it can make you miss the trees for the forest when a single concrete human being in front of you is just a bad person.
  - lyu07282 1y ago
    [flagged]
    - strogonoff 1y ago
      Sometimes it looks as if it matters more whether people are good and work in good faith rather than what a particular system is. However, the more extreme the system (be it anarchocapitalism or communism), the higher the requirement to the goodness of people. As is, in current societes I find that the ambient chaos of general democratic capitalism counteracts the threat of small minority making wrong decisions (Mao’s famine, etc.) while strategic regulations help curb bad actors abusing the system (like selling people poison or dumping toxic waste into rivers). Both are needed, and I usually suspect that people who call for one extreme or the other either have an agenda or have not thought it through. (In the West it is often pro-capitalist tendencies, though I encountered both.)
      - lyu07282 1y ago
        > democratic capitalism I don't think I have anything in response to that one.
        strogonoff 1y ago
        I was actually on your side in this, oh well!
        lyu07282 1y ago
        Only liberals could describe our system as "democratic capitalism" with a straight face, its absurd. I'm on the left, I'm not a liberal, so no, we are definitely not on the same side. I believe our intolerable levels of inequality and disparity is caused by systemic issues not some "bad actors".
        strogonoff 1y ago
        OK.
aurelien 1y ago
So true, they make bullshit that affect security also on some security tools analyser … do not worry NSA everything is fine, you are not at risk against worms xD

Arainach 1y ago

Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed. So you don't do that. You use zero trust and don't care that things are exposed to the internet. Working from anywhere (remote sites, home, your phone) is a huge benefit. Organizations want to control their data entirely while still wanting their organization to be able to access it.

anonymars 1y ago
Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!
- zamadatix 1y ago
  In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).
  - anonymars 1y ago
    So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?
    - hug 1y ago
      Yes, that's zero trust in a nutshell: A VPN that does a tunnel per TCP connection instead of one tunnel for all TCP connections. The other salient point is that all connections are established outbound through a broker, and importantly this is the case from both sides: The appliance at the terminating end of the tunnel establishes reverse tunnels to the broker for the connections, so it's never "exposed to the internet". The broker can then push to your SIEM or whatever so you can have your SOC log jockeys harass your employees for accidentally leaving NordVPN on after watching international sports. There are actual benefits: You can do things like allow logins to system A from anywhere, but system B only from your home country, you can do JIT network access requests, etc... but mostly it's vendor marketing to get you to spend too much money.

cptskippy 1y ago

> It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. Once upon a time Microsoft marketed it as, and a lot of Orgs adopted SharePoint as their Intranet. With SharePoint 2019 being sunset, a lot of Orgs are scrambling to implement replacements.

p_ing 1y ago

Hosting internal services be they SharePoint or Exchange behind a [pre-auth] reverse proxy isn't that unusual.

technion 1y ago

The product was explicitly promoted as being useful to run public websites. Before cloud took off we had Microsoft sales people in our office announcing the death of Wordpress with the latest Sharepoint release. That position may be old, but plenty of orgs live in the past.

xcrunner529 1y ago
My former boss bought that hook,line, and sinker and that’s why I was fixing the legacy cms environment today.

nickitolas 1y ago

I would assume some orgs made it public facing for covid and it remained like that

gomicrosoft 1y ago

That’s the whole thing with Azure; it blurs the line between on-prem and cloud “because you can.” I never remember thinking years ago how nice it would be to have all of our private docs that we only need to access on our private network accessible to the public. I just wasn’t thinking outside the box enough.

cindyllm 1y ago
[dead]

cirgue 1y ago

The answer is contractors and consultants. State agencies routinely work with third parties that need to be able to share files. Obviously this isn’t universal but it isn’t uncommon.

devjab 1y ago

> It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN. It likely will be entirely contained, at least in theory. Because is your IT and OT isolated? They should be, but man could I tell you something about the energy and public sectors... Let's just say, that if you're in an organisation with any sort of OT, then you may as well assume that everything you have is facing the internet in some way. I suspect it's frankly like this in any sort of enterprise organisation getting worse the more the org views IT purely as a cost center. This is why we don't just rely on things like VPNs. Everything we have uses port security (mac-adresses) at a much more ganular level than the VPN does. At least for the parts of our systems landscape where this is possible. With something like SharePoint it's hard to allow specific devices because it's usually something everyone should have some sort of access to. Then you have all the organisations where SharePoint also has some sort of non-VPN access because some CEO level wanted it at one point since they can't be bothered to bring a work PC to their Holiday home.