6 ms·

If one had an infinite monetary and user acceptability/retraining budget... what would a modern, secure 500+ seat IT infrastructure look like? Even in the broad

by tel 11y ago

If one had an infinite monetary and user acceptability/retraining budget... what would a modern, secure 500+ seat IT infrastructure look like? Even in the broadest of terms.

JoshTriplett 11y ago
You would also need to ask how much the company is willing to trade off productivity for security. With enough budget, you could have security like that of any three-letter-agency, or even more draconian, but good luck getting work done, or retaining employees. That's not to say that user data should go unprotected; the majority of people in the company should have zero access to that, such that even if their systems were compromised user data would remain safe.
tptacek 11y ago
* No unfiltered attachments in email, for definitions of "filter" that include "stripping out content and re-rendering in simpler formats", like "PDF->RTF" or something equally terrible. * Fine-grained segmentation of all networks on need-to-know basis, informed by the org chart and detailed role descriptions for virtually all employees. * No employee access to arbitrary Internet sites * For employees that require Internet access, air gaps between computers that can hit Google and computers that can access company email * Formal audits for minor software releases * Expensive, heavily tested secure coding training for all developers * Adoption of secure coding/design standards ("this is the XYZcorp way to make an SQL query" and "this is the XYZcorp way to render HTML"). Strict bans on deprecated interfaces. * Employee access to sensitive internal applications (like document and image management) gated through Citrix-like environments, so you have to remote terminal in to get to the browser that actually talks to the application. * Extremely minimal access provided to VPN users. * Total 8021x-style lockdown of network ports and fascist policies against bringing own devices. And so on. There is zero chance this is ever going to describe any huge company.
- tedunangst 11y ago
  > No employee access to arbitrary Internet sites zomg! muh freedoms!
- stevoski 11y ago
  If I worked as a developer inside such an organisation, I'd quit. A sad side-effect of rigorous IT security is the lack of productivity and day-to-day frustrations experienced by the staff. I've experienced this myself inside a major central bank. Most development staff were a) demoralised and b) frequently adopting insecure work-arounds.
  - bpicolo 11y ago
    You mean you don't want to use two entirely separate computers just so you can access email? Paranoia in excess.
    - bluedino 11y ago
      Hey, we used to use a Mac for Internet and email and a Windows machine for "work", both on the same desk.
  - tptacek 11y ago
    So would I. But another way to look at this is, instead of "I'd quit", saying "they'd have to pay me 3x more to work in a place like that". At which point you can again start looking at it as an economic problem.
    - greyboy 11y ago
      You're right. I work at a place that does all but two of those, and I wouldn't if they didn't pay me as much as they do!
      - tptacek 11y ago
        If you work at a company with more than 500 employees that does all but two of those, I'd like to hear more about that. As I wrote those bullets, I filtered them through my experience of consulting for F500 companies, and when I found myself writing something I'd seen reliably deployed across entire organizations, I edited the bullet until that was no longer the case. About the closest I've come to seeing any of these bullets deployed reliably is Microsoft's developer training and deprecation of the standard C library, and that initiative was so out-of-the-ordinary that it was newsworthy, and widely reported. But to actually earn that bullet, Microsoft would need to deploy those same measures across all its contractors, and, more importantly, deploy them on internal IT and line of business systems, not just the Windows and Office codebases.
- BlackFly 11y ago
  I feel that the biggest thing that most companies could do to safeguard a user's privacy is to just respect it: the majority of websites that ask for an email address to sign up don't truly require it for proper functioning. Either they need to sell my address to spammers to finance their business or they delusionally believe I want to read their spam.
- tl 11y ago
  > Employee access to sensitive internal applications (like document and image management) gated through Citrix-like environments, so you have to remote terminal in to get to the browser that actually talks to the application. That may be a realistic proposal, but I'm skeptical that it's the best answer, maybe because 100% of my Citrix experiences have been awful. Wouldn't "ensure internal app adhere to all other points, rewriting them if necessary" be a better answer for "given infinite money" question?
  - tptacek 11y ago
    Sure, I think you could add a bullet for "applications not gated through Citrix-like environments are written to be hardened against arbitrary client software, as opposed to the single company-spec version of Firefox that users are allowed to use in a Citrix session". You'd still have Citrix lockdown environments for any application that you can't rewrite. For instance, an F500 might license the web app it uses for image management for things like scanned medical records. I should add: I don't think any of these are realistic proposals.
Animats 11y ago
Check with a Swiss bank. They typically spend 10% of their IT costs on security. Swiss banks have a tradition of security overkill. Branches in nice areas have bulletproofing rarely seen in the US outside of very bad neighborhoods. It would be un-Swiss not to be prepared.
- tptacek 11y ago
  Have some experience there. Not meaningfully different from finance IT as a whole. Finance orgs generally fall under the bucket I described in my first comment here, of "spending enough not to be the easiest targets", so there's that!
lucb1e 11y ago
> infinite monetary and user acceptability/retraining budget In that case every employee would have one or more security people standing behind them the whole day. No email would be opened without a phone call to the sender to confirm that it's not spear phishing. But more realistically, loads and loads of 24/7 monitoring and internal auditing and testing. Attackers have to abuse something to get in, and if the company is internally doing the same thing with a large enough team, 99% is probably secure. Hackers will probably look for easier targets then. Still, this is quite unrealistic to happen in present times.

by tel 11y ago

If one had an infinite monetary and user acceptability/retraining budget... what would a modern, secure 500+ seat IT infrastructure look like? Even in the broadest of terms.

JoshTriplett 11y ago

You would also need to ask how much the company is willing to trade off productivity for security. With enough budget, you could have security like that of any three-letter-agency, or even more draconian, but good luck getting work done, or retaining employees. That's not to say that user data should go unprotected; the majority of people in the company should have zero access to that, such that even if their systems were compromised user data would remain safe.

tptacek 11y ago

* No unfiltered attachments in email, for definitions of "filter" that include "stripping out content and re-rendering in simpler formats", like "PDF->RTF" or something equally terrible. * Fine-grained segmentation of all networks on need-to-know basis, informed by the org chart and detailed role descriptions for virtually all employees. * No employee access to arbitrary Internet sites * For employees that require Internet access, air gaps between computers that can hit Google and computers that can access company email * Formal audits for minor software releases * Expensive, heavily tested secure coding training for all developers * Adoption of secure coding/design standards ("this is the XYZcorp way to make an SQL query" and "this is the XYZcorp way to render HTML"). Strict bans on deprecated interfaces. * Employee access to sensitive internal applications (like document and image management) gated through Citrix-like environments, so you have to remote terminal in to get to the browser that actually talks to the application. * Extremely minimal access provided to VPN users. * Total 8021x-style lockdown of network ports and fascist policies against bringing own devices. And so on. There is zero chance this is ever going to describe any huge company.

tedunangst 11y ago
> No employee access to arbitrary Internet sites zomg! muh freedoms!
stevoski 11y ago
If I worked as a developer inside such an organisation, I'd quit. A sad side-effect of rigorous IT security is the lack of productivity and day-to-day frustrations experienced by the staff. I've experienced this myself inside a major central bank. Most development staff were a) demoralised and b) frequently adopting insecure work-arounds.
- bpicolo 11y ago
  You mean you don't want to use two entirely separate computers just so you can access email? Paranoia in excess.
  - bluedino 11y ago
    Hey, we used to use a Mac for Internet and email and a Windows machine for "work", both on the same desk.
- tptacek 11y ago
  So would I. But another way to look at this is, instead of "I'd quit", saying "they'd have to pay me 3x more to work in a place like that". At which point you can again start looking at it as an economic problem.
  - greyboy 11y ago
    You're right. I work at a place that does all but two of those, and I wouldn't if they didn't pay me as much as they do!
    - tptacek 11y ago
      If you work at a company with more than 500 employees that does all but two of those, I'd like to hear more about that. As I wrote those bullets, I filtered them through my experience of consulting for F500 companies, and when I found myself writing something I'd seen reliably deployed across entire organizations, I edited the bullet until that was no longer the case. About the closest I've come to seeing any of these bullets deployed reliably is Microsoft's developer training and deprecation of the standard C library, and that initiative was so out-of-the-ordinary that it was newsworthy, and widely reported. But to actually earn that bullet, Microsoft would need to deploy those same measures across all its contractors, and, more importantly, deploy them on internal IT and line of business systems, not just the Windows and Office codebases.
BlackFly 11y ago
I feel that the biggest thing that most companies could do to safeguard a user's privacy is to just respect it: the majority of websites that ask for an email address to sign up don't truly require it for proper functioning. Either they need to sell my address to spammers to finance their business or they delusionally believe I want to read their spam.
tl 11y ago
> Employee access to sensitive internal applications (like document and image management) gated through Citrix-like environments, so you have to remote terminal in to get to the browser that actually talks to the application. That may be a realistic proposal, but I'm skeptical that it's the best answer, maybe because 100% of my Citrix experiences have been awful. Wouldn't "ensure internal app adhere to all other points, rewriting them if necessary" be a better answer for "given infinite money" question?
- tptacek 11y ago
  Sure, I think you could add a bullet for "applications not gated through Citrix-like environments are written to be hardened against arbitrary client software, as opposed to the single company-spec version of Firefox that users are allowed to use in a Citrix session". You'd still have Citrix lockdown environments for any application that you can't rewrite. For instance, an F500 might license the web app it uses for image management for things like scanned medical records. I should add: I don't think any of these are realistic proposals.

Animats 11y ago

Check with a Swiss bank. They typically spend 10% of their IT costs on security. Swiss banks have a tradition of security overkill. Branches in nice areas have bulletproofing rarely seen in the US outside of very bad neighborhoods. It would be un-Swiss not to be prepared.

tptacek 11y ago
Have some experience there. Not meaningfully different from finance IT as a whole. Finance orgs generally fall under the bucket I described in my first comment here, of "spending enough not to be the easiest targets", so there's that!

lucb1e 11y ago

> infinite monetary and user acceptability/retraining budget In that case every employee would have one or more security people standing behind them the whole day. No email would be opened without a phone call to the sender to confirm that it's not spear phishing. But more realistically, loads and loads of 24/7 monitoring and internal auditing and testing. Attackers have to abuse something to get in, and if the company is internally doing the same thing with a large enough team, 99% is probably secure. Hackers will probably look for easier targets then. Still, this is quite unrealistic to happen in present times.