12 ms·

People in the know: how do these breaches keep happening?

obstinate 11y ago
Security is very hard, even for the best at their best. And the people who have the information that is most sensitive are not the best, and aren't giving their best. I'm not in the know, but it seems pretty basic. Lemme know if I'm wrong.
HarryHirsch 11y ago
Insufficient liability, one would guess. Cars, airplanes, industrial plant, all these have software in them but the liability is wholly different, should an accident happen due to a software bug.
- hrbrtglm 11y ago
  I don't think that's a relevant comparison. You can be sure that when cars, airplanes and industrial plant have available access through internet, they will be powned as well and there will be accidents.
  - HarryHirsch 11y ago
    This argument was implied. If they will own your data when you put your HR database on the internet, maybe you shouldn't put your HR database on the internet to begin with. I can't be the only one who feels that computer security is a field that is insufficiently mature, yet people put confidential data on the internet all the time even though the technology isn't ripe yet to do so safely. Compare this attitude with the extremely conservative approach in rocketry. The technology is positively from the stone age, but everyone agrees that it is well understood. You can't take any other approach when space missions are multi-decade projects and the price tag has nine figures.
- dllthomas 11y ago
  Careful, though. If I put up a new Tetris clone on GitHub, and you decide to use it to control your power plant... Liability should first rest with the entities deploying the software, since those are the only ones with a picture of what can go wrong in the context where it's being deployed. Those entities should then be demanding warranty/indemnity as appropriate from their suppliers (or possibly third parties, for F/OSS).
DougN7 11y ago
Too prevent it, you have to protect against 100% of all attacks (including new emerging attacks) 100% of the time. The bad guys just have to get lucky once.
- bluecmd 11y ago
  The best course of action is to not store the data at all. Use "Sign in with Facebook" et. al and never even get the user password for example. I'm so tired of needing to have a password manager when we have good authentication platforms today.
  - juliangregorian 11y ago
    Too bad we don't have a viable decentralized option, I don't at all relish the idea of Facebook Inc. owning my online identity.
    - ryukafalz 11y ago
      Diaspora. Friendica. Pump.io. If you're more technically inclined, you can self-host one of many: https://indiewebcamp.com/projects https://indiewebcamp.com/projects There isn't just one alternative, and I don't think there really should be - the fact that most of them are interoperable means that not everyone has to be using the same software. We need to standardize on a protocol, not so much an implementation. (But yes, there does need to be a nice-looking implementation if we want the general public to use it.)
      - juliangregorian 11y ago
        Merely having wide adoption of OpenID or Mozilla Persona would be a worthy start. I just don't have much faith in these idealistic open source projects these days; when I google "diaspora oauth" and the first thing I find is abandonware (https://github.com/diaspora/diaspora-client https://github.com/diaspora/diaspora-client), it pretty much confirms my cynicism. "Nice-looking" isn't the only thing we need from identity management.
Joeri 11y ago
Prioritizing other activities over security. Probably in every one of these cases someone on the inside warned that they weren't doing enough about security, and nobody took action because there were no additional people available to work on it. Saying that security is hard is a cop out. It's the cost of doing business. Most places that are hacked should have been doing more about security.
juliangregorian 11y ago
First of all, there is no perfect security. Moreover, very few people know how to build a complete soup-to-nuts internet-facing system that has "good-enough" security at every level. The fact that there are few resources available on how to do this is an indictment of our industry. Even if your digital security model is impeccable, I'd wager a large share of these attacks involve a social engineering/disgruntled employee vector as well, which is vastly harder to protect against.
- amelius 11y ago
  > Moreover, very few people know how to build a complete soup-to-nuts internet-facing system that has "good-enough" security at every level. And even the people who do know, often don't get the time to do it correctly.
tptacek 11y ago
It is dazzlingly expensive to run a 500+ seat IT organization in a matter that is meaningfully hardened against attackers. Meanwhile, IT budgets are calibrated against the last 20 years of typical IT expenses. That's despite that fact that the last 10 years have drastically increased the risk of IT security attacks, because: * the technology adoption curve of attack techniques has made powerful attacks available to the "early majority" cohort of criminals * computer science has demonstrated flaws in foundational technology that weren't widely known 15 years ago * as online attacks have mainstreamed, an industry value chain has developed to monetize weaknesses So it's business-as-usual in IT, despite the fact that when it comes to security, "usual" has been redefined. Basically no medium/medium-large company in the world is willing to spend the amount of money (and make the usability sacrifices) it would take to reasonably ensure resiliency against attacks. The most secure firms spend anomalous amounts of money simply to elevate themselves to a point where they (a) aren't the easiest targets and (b) have bought enough time to detect and respond to incidents as they occur.
- secfirstmd 11y ago
  Excellent and very succinct analysis.
- tel 11y ago
  If one had an infinite monetary and user acceptability/retraining budget... what would a modern, secure 500+ seat IT infrastructure look like? Even in the broadest of terms.
  - JoshTriplett 11y ago
    You would also need to ask how much the company is willing to trade off productivity for security. With enough budget, you could have security like that of any three-letter-agency, or even more draconian, but good luck getting work done, or retaining employees. That's not to say that user data should go unprotected; the majority of people in the company should have zero access to that, such that even if their systems were compromised user data would remain safe.
  - tptacek 11y ago
nickpsecurity 11y ago
Assuming top-notch everything by industry standards, the systems will still likely get breached by attackers with 0-days in implementations. Brian Snow, a NSA Technical Director, explained the reason very well in his essay We Need Assurance [1]: "The problem is innately difficult because from the beginning (ENIAC, 1944), due to the high cost of components, computers were built to share resources (memory, processors, buses, etc.). If you look for a one-word synopsis of computer design philosophy, it was and is SHARING. In the security realm, the one word synopsis is SEPARATION: keeping the bad guys away from the good guys’ stuff! So today, making a computer secure requires imposing a “separation paradigm” on top of an architecture built to share. That is tough! Even when partially successful, the residual problem is going to be covert channels. We really need to focus on making a secure computer, not on making a computer secure – the point of view changes your beginning assumptions and requirements!" I'll add that the fundamental constructs and operations of a computer are designed a dumb way that will follow the most self-defeating orders. Smarter architectures, like Burroughs B5500 and System/38, existed in the past that had CPU's that enforced fine-grained separation (helps secrecy), protected pointers/stacks/arrays from abuse (stops much code injection), and could spot many problems like interface abuse (80+% of issues) at runtime. The dumb systems were cheaper, faster, & backward-compatible with garbage tools in widespread use. So the market went with them. To this day, most "security professionals" have no clue that there existed hardware & software systems so resistant to compromise that NSA's red teams gave up on even watered-down versions of them. And then bought them for protecting most sensitive stuff while pushing weaker stuff on us for their other mission. ;) Fortunately, there is a tiny, niche part of the security community working on such "high assurance" solutions (eg crash-safe.org) or at least better architectures w/ some higher assurance components (eg genode.org). Our niche is not popular, has few customers, and never will mainstream due to tough tradeoffs it forces. Yet, real security is gaining a bit more traction in academia and some software firms. One day such platforms might get more affordable and widely available so they you can use one without lost sleep due to someone opening an email. :) [1] http://www.acsac.org/2005/papers/Snow.pdf http://www.acsac.org/2005/papers/Snow.pdf

Security is very hard, even for the best at their best. And the people who have the information that is most sensitive are not the best, and aren't giving their best. I'm not in the know, but it seems pretty basic. Lemme know if I'm wrong.

HarryHirsch 11y ago

Insufficient liability, one would guess. Cars, airplanes, industrial plant, all these have software in them but the liability is wholly different, should an accident happen due to a software bug.

hrbrtglm 11y ago
I don't think that's a relevant comparison. You can be sure that when cars, airplanes and industrial plant have available access through internet, they will be powned as well and there will be accidents.
- HarryHirsch 11y ago
  This argument was implied. If they will own your data when you put your HR database on the internet, maybe you shouldn't put your HR database on the internet to begin with. I can't be the only one who feels that computer security is a field that is insufficiently mature, yet people put confidential data on the internet all the time even though the technology isn't ripe yet to do so safely. Compare this attitude with the extremely conservative approach in rocketry. The technology is positively from the stone age, but everyone agrees that it is well understood. You can't take any other approach when space missions are multi-decade projects and the price tag has nine figures.
dllthomas 11y ago
Careful, though. If I put up a new Tetris clone on GitHub, and you decide to use it to control your power plant... Liability should first rest with the entities deploying the software, since those are the only ones with a picture of what can go wrong in the context where it's being deployed. Those entities should then be demanding warranty/indemnity as appropriate from their suppliers (or possibly third parties, for F/OSS).

DougN7 11y ago

Too prevent it, you have to protect against 100% of all attacks (including new emerging attacks) 100% of the time. The bad guys just have to get lucky once.

bluecmd 11y ago
The best course of action is to not store the data at all. Use "Sign in with Facebook" et. al and never even get the user password for example. I'm so tired of needing to have a password manager when we have good authentication platforms today.
- juliangregorian 11y ago
  Too bad we don't have a viable decentralized option, I don't at all relish the idea of Facebook Inc. owning my online identity.
  - ryukafalz 11y ago
    Diaspora. Friendica. Pump.io. If you're more technically inclined, you can self-host one of many: https://indiewebcamp.com/projects https://indiewebcamp.com/projects There isn't just one alternative, and I don't think there really should be - the fact that most of them are interoperable means that not everyone has to be using the same software. We need to standardize on a protocol, not so much an implementation. (But yes, there does need to be a nice-looking implementation if we want the general public to use it.)
    - juliangregorian 11y ago
      Merely having wide adoption of OpenID or Mozilla Persona would be a worthy start. I just don't have much faith in these idealistic open source projects these days; when I google "diaspora oauth" and the first thing I find is abandonware (https://github.com/diaspora/diaspora-client https://github.com/diaspora/diaspora-client), it pretty much confirms my cynicism. "Nice-looking" isn't the only thing we need from identity management.

Joeri 11y ago

Prioritizing other activities over security. Probably in every one of these cases someone on the inside warned that they weren't doing enough about security, and nobody took action because there were no additional people available to work on it. Saying that security is hard is a cop out. It's the cost of doing business. Most places that are hacked should have been doing more about security.

juliangregorian 11y ago

First of all, there is no perfect security. Moreover, very few people know how to build a complete soup-to-nuts internet-facing system that has "good-enough" security at every level. The fact that there are few resources available on how to do this is an indictment of our industry. Even if your digital security model is impeccable, I'd wager a large share of these attacks involve a social engineering/disgruntled employee vector as well, which is vastly harder to protect against.

amelius 11y ago
> Moreover, very few people know how to build a complete soup-to-nuts internet-facing system that has "good-enough" security at every level. And even the people who do know, often don't get the time to do it correctly.

tptacek 11y ago

It is dazzlingly expensive to run a 500+ seat IT organization in a matter that is meaningfully hardened against attackers. Meanwhile, IT budgets are calibrated against the last 20 years of typical IT expenses. That's despite that fact that the last 10 years have drastically increased the risk of IT security attacks, because: * the technology adoption curve of attack techniques has made powerful attacks available to the "early majority" cohort of criminals * computer science has demonstrated flaws in foundational technology that weren't widely known 15 years ago * as online attacks have mainstreamed, an industry value chain has developed to monetize weaknesses So it's business-as-usual in IT, despite the fact that when it comes to security, "usual" has been redefined. Basically no medium/medium-large company in the world is willing to spend the amount of money (and make the usability sacrifices) it would take to reasonably ensure resiliency against attacks. The most secure firms spend anomalous amounts of money simply to elevate themselves to a point where they (a) aren't the easiest targets and (b) have bought enough time to detect and respond to incidents as they occur.

secfirstmd 11y ago
Excellent and very succinct analysis.
tel 11y ago
If one had an infinite monetary and user acceptability/retraining budget... what would a modern, secure 500+ seat IT infrastructure look like? Even in the broadest of terms.
- JoshTriplett 11y ago
  You would also need to ask how much the company is willing to trade off productivity for security. With enough budget, you could have security like that of any three-letter-agency, or even more draconian, but good luck getting work done, or retaining employees. That's not to say that user data should go unprotected; the majority of people in the company should have zero access to that, such that even if their systems were compromised user data would remain safe.
- tptacek 11y ago

nickpsecurity 11y ago

Assuming top-notch everything by industry standards, the systems will still likely get breached by attackers with 0-days in implementations. Brian Snow, a NSA Technical Director, explained the reason very well in his essay We Need Assurance [1]: "The problem is innately difficult because from the beginning (ENIAC, 1944), due to the high cost of components, computers were built to share resources (memory, processors, buses, etc.). If you look for a one-word synopsis of computer design philosophy, it was and is SHARING. In the security realm, the one word synopsis is SEPARATION: keeping the bad guys away from the good guys’ stuff! So today, making a computer secure requires imposing a “separation paradigm” on top of an architecture built to share. That is tough! Even when partially successful, the residual problem is going to be covert channels. We really need to focus on making a secure computer, not on making a computer secure – the point of view changes your beginning assumptions and requirements!" I'll add that the fundamental constructs and operations of a computer are designed a dumb way that will follow the most self-defeating orders. Smarter architectures, like Burroughs B5500 and System/38, existed in the past that had CPU's that enforced fine-grained separation (helps secrecy), protected pointers/stacks/arrays from abuse (stops much code injection), and could spot many problems like interface abuse (80+% of issues) at runtime. The dumb systems were cheaper, faster, & backward-compatible with garbage tools in widespread use. So the market went with them. To this day, most "security professionals" have no clue that there existed hardware & software systems so resistant to compromise that NSA's red teams gave up on even watered-down versions of them. And then bought them for protecting most sensitive stuff while pushing weaker stuff on us for their other mission. ;) Fortunately, there is a tiny, niche part of the security community working on such "high assurance" solutions (eg crash-safe.org) or at least better architectures w/ some higher assurance components (eg genode.org). Our niche is not popular, has few customers, and never will mainstream due to tough tradeoffs it forces. Yet, real security is gaining a bit more traction in academia and some software firms. One day such platforms might get more affordable and widely available so they you can use one without lost sleep due to someone opening an email. :) [1] http://www.acsac.org/2005/papers/Snow.pdf http://www.acsac.org/2005/papers/Snow.pdf