Hacker News Reader

Comment by harshreality | Hacker News Reader

> But nobody should pretend that RCE on an on-prem webserver wouldn't be game-over, for the entire internal network, across the majority of the Fortune 100.

You certainly have more experience with this than the vast majority of the rest of us, but with that kind of data on millions of people, shouldn't it be, and why isn't it, standard practice to put servers storing that data behind an extremely limited API, with a firewall in place to monitor queries and responses and severely rate-limit or stop additional traffic if something suspicious happens, until the monitoring people can take a look?

View on HN

Because that not only adds operational expense but also requires engineering teams to have a level of systems engineering expertise and diligence that virtually no line-of-business software project has.

*adds operational expense without a counterparty willing to pay for that expense

Those with data on Equifax's servers aren't Equifax's customers, so other than "not having a PR cluster&#@_" economic incentives are not aligned to prevent this.

It's probably best to treat Equifax specially rather than making an example out of them for the rest of the industry to follow.

If they aren't qualified to design with least privilege, what are they qualified for, beyond maybe cat videos?

I've spent about half my professional career finding vulnerabilities in the software of developers who are convinced they're "qualified to design with least privilege".

And, even if you know what you are doing, this is intrinsically a hard problem, you need to know exactly what information should be accessible to each server

You can add all the security layers you want, but if the web server needs to display a piece of information, the web server must have access to that information. The keys must be in the car somewhere.

Also... even with multiple layers, what do you think the backend stack would be? Unless it's built by a separate team deliberately using a different technology platform, you're stuck with the same Struts (or whatever) vulnerability.

Reply on news.ycombinator.com