Hacker News Reader

Comment by Kalium | Hacker News Reader

Let's say you're a CEO at Big Pipeline Co. One day your phone rings. It's the NSA.

They say your systems are vulnerable as hell. That you're very likely going to be breached in a quite expensive way very soon. It could shut down all the pipes on which Big Pipeline Co depends!

They offer to patch your systems for you. Do you accept, knowing that your staff will have to hand over hundreds to thousands of credentials? Knowing that the employees of the NSA care more about patching than if your systems work afterwards, and you have no real recourse if they screw up?

If you don't accept, what would you prefer the NSA do to secure your company's systems?

View on HN

Let's say you're the Chairman of the Board of Directors at Big Pipeline Co. One day your phone rings. It's the NSA.

They say your systems are vulnerable as hell, and they told the CEO about it, but he did nothing. He didn't allow the NSA to come in and fix anything; he also didn't take any action on his own to have people internal to the corporation fix it.

What's your obvious response? Fire the CEO and install a new one who will direct the appropriate resources to fixing the problem.

What CEOs have ever been fired for security breaches? If the "free market" doesn't care, why would any "I told you so" from the gov't make any difference. He'll have already taken his golden parachute and some poor CSO will take the fall.

> What CEOs have ever been fired for security breaches?

None. That's part of my point: the root problem is not actually security by itself, it's bad corporate governance. CEOs should be fired for such things, but they're not.

> If the "free market" doesn't care

Corporate governance is not a free market nowadays. It was more of one in the past (although an argument can be made that there were important non-free market forces even then), when most stock ownership was in the hands of individuals who at least had some incentive to hold boards of directors accountable for long-term stewardship, since they were investing with a long time horizon for their own retirement.

But now most stock ownership is in the hands of large mutual funds (since that's where most people's retirement funds are now), which don't care about long-term stewardship; they only care about short-term earnings. So corporations have a positive incentive to overlook things that, to be fixed, will require sacrificing short-term earnings for long-term stewardship. Individual investors never even see this; all they see is the overall rate of return of their mutual funds. So they don't realize the long-term consequences of what is going on and aren't able to apply free market incentives to correct things.

To play devil's advocate, how much money did this breach actually cost the pipeline? A few million bucks?

That's probably a rounding error on their quarterly report. Heck, it might have cost them more money to hire more people to provide adequate security to prevent such attacks than to just suck it up and get attacked.

It may actually be economically favorable to stay insecure!

If that were the case, the market would actually encourage CEO's to spend less money on security, not more.

There's a running joke in the security community that CSO stands for Chief Sacrificial Officer.

Surely the NSA can tell companies about their vulnerabilities without having to actually log in and fix them? "You have a server on 23.117.25.208:3999 which is vulnerable to CVE-2021-1120, fix it."

Sure!

Realistically, I find it not credible to believe that nobody in big infrastructure companies with IT departments is aware that they have vulnerable systems. I find it far more likely that people are aware and people in positions of leadership making decisions about risk have decided that these risks are acceptable.

Do you think getting an email from the NSA telling IT what they already know is going to change those calculations? My experience with bug bounty programs is that leaders who make risk decisions are more likely to shrug and say "I know, we're OK with that risk".

I realize that this is a personal judgment, and other people may have had wildly different experiences.

> an email from the NSA telling IT what they already know

No, that's not what the email from NSA would say. It would not say "there is a risk of your systems being compromised by cyberattack" in general terms, which is what IT already knows. It would say "your systems are vulnerable to these specific attacks", which IT does not know. So yes, getting this new information should change the risk-benefit calculation dramatically.

I've been on the receiving end of various emails like that. They have details on specific systems and specific attacks. They're occasionally useful, but often not. Knowing that a particular app is vulnerable to XSS might be useful, if I have staff that can fix it and they have the spare cycles.

For example, a hospital IT department might get an email telling them that their MRI is exposing remote desktop to the internet with default credentials. They know that. They don't change it because if they do, their vendor will drop support. This is a real thing that real medical hardware has to deal with, and it's only slowly getting better.

A big industrial company might easily have it worse than a hospital. Fixing the specific CVE on a specific port on a specific machine might mean having to retire a whole series of obscure, niche bits of SCADA hardware that don't support anything modern. It's like all those IoT gadgets that don't support 5GHz, writ large.

https://en.wikipedia.org/wiki/SCADA#Security_issues

Somewhere between those two, you have your well-run Windows network. It's probably a month to several months of patching behind. IT has a whole process to test any new patches for stability and compatibility with line-of-business software to ensure that nothing breaks. Knowing that their systems are vulnerable to the CVE that's fixed by a patch they're testing - or tested and found broke something important - might not always help them very much.

If the message comes with, "You have X time to fix this or you will have Y penalty" it definitely changes the risk/reward equation. Severe enough penalties moves it from "if we have spare cycles" to "how do we get this done."

The NSA’s mission-statement in domestic civic cybersecurity is to ensure the flow of commerce, i.e. to protect GDP. They aren’t going to patch things in a way that makes them not do their jobs any more. That’d be an “attack on commerce” just as much as exploiting the vuln would be.

That's true in broad strokes, but I'm trying to portray things from the position of an executive. Having a bunch of outsiders that you have no real influence over in charge of your systems is terrifying.

The alternatives are a regulatory system for information security or offering advice and hoping companies implement it. There's a lot of advice on offer.

Let's say that you're a CEO at Big Pipeline Co. One day your phone rings. It's the NSA.

They have a report with a list of vulnerabilities. If you don't fix them to your satisfaction, you will be fined in 2 months, 2 months after that you get fined and publicly reported as negligent, and 2 months after that you get fined again and your outstanding vulnerabilities will be published for everyone to take advantage of.

How much effort are you going to put in to securing your infrastructure?

I’d prefer the NSA put in the hard effort to shed their reputation as spies and start by offering plain security advice in the open that can be verified by independent experts. The best way forward is for the NSA to focus on providing high quality security advice, best practices, and guidance to critical infrastructure. This doesn’t involve handing over the “keys to the kingdom”.

https://www.nsa.gov/What-We-Do/Cybersecurity/Advisories-Tech...

The NSA seems to agree with you. So do the Departments of Energy, Commerce, and Defense, all of which have various efforts to provide independently verifiable high quality security advice, best practices, and guidance. In some cases, they've been doing so for years.

But let's skip the NSA bit. Let's say you, CEO of Big Pipeline Co, have been called up by someone at The Office of Cybersecurity, Energy Security, and Emergency Response within the Department of Energy. They offer you all the advice and guidance you could wish for. Now it's up to you to budget resources. What do you do?

Realistically, you probably hand that advice off to your IT or software staff and hope for the best. Though I realize that reasonable people may differ on this point.

The law should require certain minimums of security for infrastructure deemed vital, like oil pipelines. If entertainment companies and HIPPA can ensure those they work with practice good cybersecurity, why can't the government do the same?

https://www.energy.gov/national-security-safety/cybersecurit...

There's already branches of cabinet-level departments that try to do this. In my opinion they're having about the same level of efficacy as one might expect in any other set of large-scale changes in very large old companies with a wide variety of internal systems and needs. If you look you'll find a plethora of government-led attempts to secure various critical industries.

You'll also note that entertainment companies and hospitals are routinely breached. There's perhaps room to question if they are indeed practicing good cybersecurity.

> They offer to patch your systems for you.

That is certainly not how it works. See the links others posted for context. NSA is more likely to inform you of the vulnerabilities and associated mitigations.

I understand that's not how it works. I'm constructing a deliberately absurd example to show both how the NSA could help and why companies wouldn't accept it.

Reply on news.ycombinator.com