3 ms·

Retaliation is a side show. Focus on hardening. The same sets of laws that exist for products and environmental liabilty must be implemented for information

by rrggrr 11y ago

Retaliation is a side show. Focus on hardening. The same sets of laws that exist for products and environmental liabilty must be implemented for information liability. Make companies economically liable for hardening their software and hardware and the lawyers will get it done. If there is one thing our overly litigious system is good it... Its extracting economic penalties for failure.

akshatpradhan 11y ago
>Retaliation is a side show. Focus on hardening. Think of a fort. Forts had defined security controls in the old times. In a fort, you go through a security rotation of making sure the pot of boiling oil tips over on time. You practice your smoke signaling so that the appropriate people are notified in the event of a wall breach. You measure your walls and review their height periodically. You protect transports carrying crown jewels. But the only way to make sure all these worked effectively was to write down their processes down and practice them. You need a systematic checklist to control your sensitive environment and protect your fort. In an agile environment, keeping all the processes in your head is painful. By prescribing to a series of security rotations (e.g. Code review process, Change control process, Log review process, Key Rotation process, Secure Delete process) you can provide accountability that reasonable steps were taken to build your fort and protect your crown jewels. 1. Boundary Control (e.g. Firewall, Router, Switch) 2. System Hardening (e.g. Chef, Puppet) 3. Data Storage (e.g. SAN, File Servers) 4. Data Encryption (e.g. VPN, TLS, SSH) 5. Malware Protection (e.g. App Isolation Containers) 6. Source Code Analysis (e.g. Unit Testing, Integration Testing, Code Coverage, Linting, Code Formatting, Brakeman) 7. Authorization/Authentication (e.g. LDAP) 8. Physical Access (e.g. Badges) 9. Log Monitoring (e.g. FIM, Logstash, Papertrail, Splunk) 10. Intrusion Prevention (e.g. Snort, Metasploit, Burp suite, Nmap, Nessus, Kismet) 11. Write current processes (e.g. Code review process, Change control process, Log review process, Key Rotation process, Secure Delete process) Its writing down current processes (and following them) that's the missing piece to a holistic security program. The other missing piece to a hardened environment is buy-in from the three primary stakeholders that hold up the fort: Sysadmins, Developers, and Security Officers. Developers don't realize the importance of Source Code Analysis. Is your code even 80% covered? That's a big part of building up a good defense :).
jsprogrammer 11y ago
Are there any proven (or speculated) damages? If no one was actually damaged, is there really liability?
- nitrogen 11y ago
  In cases where damages in aggregate are obvious but difficult to prove in specific, laws have provided statutory damages or fines.
SG- 11y ago
I couldn't agree more, it's completely ridiculous. The sad part is I believe they actually have a department that was/is in charge of it (NSA), but they've been completely focused on "terrorism" (the kinds where stuff blows up) and offensive work.
TTPrograms 11y ago
To be fair, in the modern international climate, we've seen that wars between developed countries have dropped off drastically because of the development of nuclear weapons and the creation of MAD. There are few truly formidable defensive structures from the past 100 years - the circumvented Maginot Line and the overrun encampments on the beaches of Normandy come to mind. The point being that it doesn't seem unreasonable to expect that a legion of military minds trained in deterrence as the primary response to threats from rational entities would think first to build the capability to retaliate and second the capability to defend. I'm not really sure how far the comparison between physical military threat and cyber threat really carries, though.

by rrggrr 11y ago

akshatpradhan 11y ago

>Retaliation is a side show. Focus on hardening. Think of a fort. Forts had defined security controls in the old times. In a fort, you go through a security rotation of making sure the pot of boiling oil tips over on time. You practice your smoke signaling so that the appropriate people are notified in the event of a wall breach. You measure your walls and review their height periodically. You protect transports carrying crown jewels. But the only way to make sure all these worked effectively was to write down their processes down and practice them. You need a systematic checklist to control your sensitive environment and protect your fort. In an agile environment, keeping all the processes in your head is painful. By prescribing to a series of security rotations (e.g. Code review process, Change control process, Log review process, Key Rotation process, Secure Delete process) you can provide accountability that reasonable steps were taken to build your fort and protect your crown jewels. 1. Boundary Control (e.g. Firewall, Router, Switch) 2. System Hardening (e.g. Chef, Puppet) 3. Data Storage (e.g. SAN, File Servers) 4. Data Encryption (e.g. VPN, TLS, SSH) 5. Malware Protection (e.g. App Isolation Containers) 6. Source Code Analysis (e.g. Unit Testing, Integration Testing, Code Coverage, Linting, Code Formatting, Brakeman) 7. Authorization/Authentication (e.g. LDAP) 8. Physical Access (e.g. Badges) 9. Log Monitoring (e.g. FIM, Logstash, Papertrail, Splunk) 10. Intrusion Prevention (e.g. Snort, Metasploit, Burp suite, Nmap, Nessus, Kismet) 11. Write current processes (e.g. Code review process, Change control process, Log review process, Key Rotation process, Secure Delete process) Its writing down current processes (and following them) that's the missing piece to a holistic security program. The other missing piece to a hardened environment is buy-in from the three primary stakeholders that hold up the fort: Sysadmins, Developers, and Security Officers. Developers don't realize the importance of Source Code Analysis. Is your code even 80% covered? That's a big part of building up a good defense :).

jsprogrammer 11y ago

Are there any proven (or speculated) damages? If no one was actually damaged, is there really liability?

nitrogen 11y ago
In cases where damages in aggregate are obvious but difficult to prove in specific, laws have provided statutory damages or fines.

SG- 11y ago

I couldn't agree more, it's completely ridiculous. The sad part is I believe they actually have a department that was/is in charge of it (NSA), but they've been completely focused on "terrorism" (the kinds where stuff blows up) and offensive work.

TTPrograms 11y ago

To be fair, in the modern international climate, we've seen that wars between developed countries have dropped off drastically because of the development of nuclear weapons and the creation of MAD. There are few truly formidable defensive structures from the past 100 years - the circumvented Maginot Line and the overrun encampments on the beaches of Normandy come to mind. The point being that it doesn't seem unreasonable to expect that a legion of military minds trained in deterrence as the primary response to threats from rational entities would think first to build the capability to retaliate and second the capability to defend. I'm not really sure how far the comparison between physical military threat and cyber threat really carries, though.