3 ms·

Relying on good will and people doing the right thing is clearly bullshit - any system which is insecure should be a legitimate target, and the onus needs to be

by jen20 7mo ago

Relying on good will and people doing the right thing is clearly bullshit - any system which is insecure should be a legitimate target, and the onus needs to be on those who own the systems to secure them, and be unable to disclaim liability if they do not. However, the law needs to reflect that if people are to actually take the suggestions seriously.

thatguy0900 7mo ago
Is there practical ways other than spending a couple billion dollars to protect yourself from nation state hacking groups? Especially if you'd doing something like internet connected medical devices? Honest question
- jen20 7mo ago
  The problem is, it doesn't matter. If the "good guys" are prevented from testing your system to uncover vulnerabilities without legal threats, but the "bad guys" are not, you still effectively do need to spend that anyway.
- malwrar 7mo ago
  You can’t really avoid paying for security, which seems to historically be why it is ignored and risked. I’ve always felt the right approach is for an internal security & reliability org be formed to provide an owner and maintainer for core services and libraries, so that things are built robustly from the get-go. Think premade formulations an integration for auth, hosting, data storage, etc. Some companies have small security teams that _kind of_ fill this role, but usually they’re a gate you must pass rather than an ally helping you navigate hard problems by providing and maintaining prebuilt solutions. I’d rather just require that normal devs not need to solve these problems and instead be provided an appropriate sandbox to deploy software in.
- megous 7mo ago
  They did login on a global admin account and wiped devices via whatever turd technology is used currently to have complete control over your employee's devices centrally. Central control over everything gives you central way to shoot yourself in the foot. Duh. Don't be a control freak company maybe, or if you are, have 2FA on your admin's accounts. "Nation state" my ass. They also demonstrated that one rogue admin could have deleted the entire company in like one evening, too, if he felt bad enough. Well, they also relied on this company to protect them, so... https://www.bleepingcomputer.com/news/security/microsoft-entra-id-flaw-allowed-hijacking-any-companys-tenant/ https://www.bleepingcomputer.com/news/security/microsoft-ent...
drivingmenuts 7mo ago
> any system which is insecure should be a legitimate target, and the onus needs to be on those who own the systems to secure them, and be unable to disclaim liability if they do not And what is the limit on that, because the only actually-secured system is one that is not connected to anything or accessed by anyone. Look, I agree that people are shit and the only person you can trust is one you've killed yourself, but that's not really a workable solution.
- jen20 7mo ago
  Well then how do you propose to police that outside of your own jurisdiction?
VladVladikoff 7mo ago
>his front door used an old style of insecure lock, so I spent 4 hours picking it. It’s his fault for not having a more secure lock.
kstrauser 7mo ago
Say I do everything right and still get compromised because an AWS 0-day lets attackers read the RAM of my virtual server. It’s my responsibility, but is it my fault? There’s no such thing as a secure system that’s usable. You can asymptomatically approach it giving infinite money, in the same way you can approach physical security (“if it were really important to you, you would’ve cloned Fort Knox, so I guess you don’t care”) or even the speed of light. But even Fort Knox is vulnerable to a highly determined invading army. Getting compromised doesn’t inherently mean you made mistakes.
- fn-mote 7mo ago
  > Getting compromised doesn’t inherently mean you made mistakes. I entirely agree, but I think the reason you see such upset posts is that they are thinking of situations where EGREGIOUS mistakes were made and no liability was found.
  - kstrauser 7mo ago
    I'm sure that's right, and I also find that frustrating. It just rubs me the wrong way, like people who say goofy things like "all CEOs suck". They're picturing [insert your least favorite CEO here], but probably don't know, or temporarily forget, that the local bodega's owner very well might be the CEO of an S-corp that operates their little store for liability purposes.
- Hasslequest 7mo ago
  You chose to use AWS
  - hedora 7mo ago
    And to steal all my data and put it in RAM.

by jen20 7mo ago

thatguy0900 7mo ago

Is there practical ways other than spending a couple billion dollars to protect yourself from nation state hacking groups? Especially if you'd doing something like internet connected medical devices? Honest question

jen20 7mo ago
The problem is, it doesn't matter. If the "good guys" are prevented from testing your system to uncover vulnerabilities without legal threats, but the "bad guys" are not, you still effectively do need to spend that anyway.
malwrar 7mo ago
You can’t really avoid paying for security, which seems to historically be why it is ignored and risked. I’ve always felt the right approach is for an internal security & reliability org be formed to provide an owner and maintainer for core services and libraries, so that things are built robustly from the get-go. Think premade formulations an integration for auth, hosting, data storage, etc. Some companies have small security teams that _kind of_ fill this role, but usually they’re a gate you must pass rather than an ally helping you navigate hard problems by providing and maintaining prebuilt solutions. I’d rather just require that normal devs not need to solve these problems and instead be provided an appropriate sandbox to deploy software in.
megous 7mo ago
They did login on a global admin account and wiped devices via whatever turd technology is used currently to have complete control over your employee's devices centrally. Central control over everything gives you central way to shoot yourself in the foot. Duh. Don't be a control freak company maybe, or if you are, have 2FA on your admin's accounts. "Nation state" my ass. They also demonstrated that one rogue admin could have deleted the entire company in like one evening, too, if he felt bad enough. Well, they also relied on this company to protect them, so... https://www.bleepingcomputer.com/news/security/microsoft-entra-id-flaw-allowed-hijacking-any-companys-tenant/ https://www.bleepingcomputer.com/news/security/microsoft-ent...

drivingmenuts 7mo ago

> any system which is insecure should be a legitimate target, and the onus needs to be on those who own the systems to secure them, and be unable to disclaim liability if they do not And what is the limit on that, because the only actually-secured system is one that is not connected to anything or accessed by anyone. Look, I agree that people are shit and the only person you can trust is one you've killed yourself, but that's not really a workable solution.

jen20 7mo ago
Well then how do you propose to police that outside of your own jurisdiction?

VladVladikoff 7mo ago

>his front door used an old style of insecure lock, so I spent 4 hours picking it. It’s his fault for not having a more secure lock.

kstrauser 7mo ago

Say I do everything right and still get compromised because an AWS 0-day lets attackers read the RAM of my virtual server. It’s my responsibility, but is it my fault? There’s no such thing as a secure system that’s usable. You can asymptomatically approach it giving infinite money, in the same way you can approach physical security (“if it were really important to you, you would’ve cloned Fort Knox, so I guess you don’t care”) or even the speed of light. But even Fort Knox is vulnerable to a highly determined invading army. Getting compromised doesn’t inherently mean you made mistakes.

fn-mote 7mo ago
> Getting compromised doesn’t inherently mean you made mistakes. I entirely agree, but I think the reason you see such upset posts is that they are thinking of situations where EGREGIOUS mistakes were made and no liability was found.
- kstrauser 7mo ago
  I'm sure that's right, and I also find that frustrating. It just rubs me the wrong way, like people who say goofy things like "all CEOs suck". They're picturing [insert your least favorite CEO here], but probably don't know, or temporarily forget, that the local bodega's owner very well might be the CEO of an S-corp that operates their little store for liability purposes.
Hasslequest 7mo ago
You chose to use AWS
- hedora 7mo ago
  And to steal all my data and put it in RAM.