4 ms·

Unless that internal corporate network is airgapped, it was put on the Internet for all intents and purposes.

by debacle 12y ago

Cushman 12y ago
If we're talking about the general public here, I think we're going to want to come up with more nuanced guidance than "Don't store private data on any internet-connected computer, ever."
- debacle 12y ago
  I think the better solution is to just assume insecurity. Don't send dick pics to anyone, etc.
  - Cushman 12y ago
    Maybe we're talking past each other here-- there's a significant qualitative difference between the risks of uploading data to a globally-routable server somewhere, and storing that same data on a firewalled, password-protected system on an internal network which could theoretically be owned from outside. The former is obviously unsolvable, and "don't transmit anything you don't want shared" is good advice. But surely we want to arrive at a world where typical end users can feel secure about the data on their own computer, even if it is plugged into an ethernet jack.
    - debacle 12y ago
      You should feel relatively secure, but you should not be amazed if that information gets copied/stolen.
      - Cushman 12y ago
        Aren't those things logically inconsistent? If I feel secure about my data, it means I have a strong expectation that it won't be stolen. But again, we're talking about different stuff. Obviously the people reading this, who know what "zero-day" means, won't be shocked by any individual attack. That doesn't make it a good idea to encourage end users to believe that all computers are inherently untrustworthy. Normatively speaking, we should set an expectation of high security in general, s.t. normal people can have faith that if they use recommended software, and follow the rules, they're safe at least from non-state attacks. After all-- if computers are inherently untrustworthy, why should users bother to follow the rules? (From the sounds of it, that might be exactly what happened to Sony.)
worklogin 12y ago
No. Put on a networked machine, maybe. But despite the buzzword-lathered Cisco releases, there is such a thing as "internal networks" and heightened security zones. Your bank account being on a server in a datacenter doesn't make it "on the Internet", and there is absolutely a higher expectation of privacy when sending messages on a protected email exchange vs. IRC on Freenode.
- debacle 12y ago
  Yes, and this incident proves that that expectation is wrong.
  - unethical_ban 12y ago
    The incident proves that Sony is incompetent and didn't prioritize cybersecurity the way an information-based company should. The network is a lot more porous these days, but if your bold assertion were as serious as you think, then every bank in the world would be popped. Sony was the slowest deer.

Unless that internal corporate network is airgapped, it was put on the Internet for all intents and purposes.

by debacle 12y ago

Unless that internal corporate network is airgapped, it was put on the Internet for all intents and purposes.

If we're talking about the general public here, I think we're going to want to come up with more nuanced guidance than "Don't store private data on any internet-connected computer, ever."

debacle 12y ago
I think the better solution is to just assume insecurity. Don't send dick pics to anyone, etc.
- Cushman 12y ago
  Maybe we're talking past each other here-- there's a significant qualitative difference between the risks of uploading data to a globally-routable server somewhere, and storing that same data on a firewalled, password-protected system on an internal network which could theoretically be owned from outside. The former is obviously unsolvable, and "don't transmit anything you don't want shared" is good advice. But surely we want to arrive at a world where typical end users can feel secure about the data on their own computer, even if it is plugged into an ethernet jack.
  - debacle 12y ago
    You should feel relatively secure, but you should not be amazed if that information gets copied/stolen.
    - Cushman 12y ago
      Aren't those things logically inconsistent? If I feel secure about my data, it means I have a strong expectation that it won't be stolen. But again, we're talking about different stuff. Obviously the people reading this, who know what "zero-day" means, won't be shocked by any individual attack. That doesn't make it a good idea to encourage end users to believe that all computers are inherently untrustworthy. Normatively speaking, we should set an expectation of high security in general, s.t. normal people can have faith that if they use recommended software, and follow the rules, they're safe at least from non-state attacks. After all-- if computers are inherently untrustworthy, why should users bother to follow the rules? (From the sounds of it, that might be exactly what happened to Sony.)

worklogin 12y ago

No. Put on a networked machine, maybe. But despite the buzzword-lathered Cisco releases, there is such a thing as "internal networks" and heightened security zones. Your bank account being on a server in a datacenter doesn't make it "on the Internet", and there is absolutely a higher expectation of privacy when sending messages on a protected email exchange vs. IRC on Freenode.

debacle 12y ago
Yes, and this incident proves that that expectation is wrong.
- unethical_ban 12y ago
  The incident proves that Sony is incompetent and didn't prioritize cybersecurity the way an information-based company should. The network is a lot more porous these days, but if your bold assertion were as serious as you think, then every bank in the world would be popped. Sony was the slowest deer.