Comment by rjzzleep | Hacker News Reader

Comment by rjzzleep | Hacker News Reader

Parent Full thread

A lot of these companies are actually huge enterprises with dozens if not hundred(s) of cybersecurity consultants and engineers. All of them are CISSPs and GICSPs(I do put my CISSP in the signature when working in those places too though).

I go through security reviews all the time with them, they have so many security processes that you get dizzy and on paper everything looks fine. They create security zones with massive risk reviews, but for some reason those security zones then share subnets with the entire LAN.

They also have a default configuration which makes everything access the standard intranet directory once its deemed secure. Enterprise security tools like Cyberark are deemed more secure than say yubikey HSMs, which may result in root ssh being enabled in a lot of settings. They have system configurations that are done with massive Excel sheets. Their cloud VPCs basically only have one risk profile and once its deemed secure it gets access to things in the intranet. They also vehemently refuse to do threat modelling when designing anything.

These people can tell you so much about the theory of security by heart that it will make you dizzy but then won't actually understand the underlying problems.

And the offenders are always the same, advised by Accenture, Infosys etc.

>These people can tell you so much about the theory of security by heart that it will make you dizzy but then won't actually understand the underlying problems.

I've thought greatest failure of many professionals in this field is in the "protect the network" perspective rather than "protect the data". While many of them fess up to "we can make it difficult but not impossible" to breach the network, that is not evinced by the protections instituted.

If companies actually understood that they WILL be hacked, the focus would turn to protecting the data. Actual resting data protection would allow a "I don't care if I'm hacked," posture. Either behind encryption, VM's, segregation, or architectures, preferably all, if data is actually protected, then a hack can be weathered. It's still a pain if the computer-touchers have to rebuild and reload, but that's what you pay them for. If the data is protected, a hack is just a painful exercise rather than a newsworthy event.

I do understand that segregating (through protection and architecture) data is difficult, but I do not understand why it is not the focus.

I always thought that when thinking security a compromised system HAS to be rebuilt. I have never seen that happen in an enterprise though. They never ever rebuild compromised systems they just try to improve perimeter protection.

Rebuilding the entire IT deployment is prohibitively expensive.

Imagine if the solution to Covid was "the virus can spread to anyone, we need to replace all humans"

When a machine/server/laptop/PC is hacked, it's considered compromised. No amount of pruning that system can restore trust in it. It needs to be reset.

It's only prohibitively expensive because most of these enterprise tools and servers are actually very much focused on manual setup.

>> Actual resting data protection would allow a "I don't care if I'm hacked," posture.

That's quite interesting. Where can I read more about that ?

I think something along these lines is called “zero trust” and especially Google has been aggressively implementing it. But I could not find have any high quality articles on the concept.

https://www.csoonline.com/article/3247848/what-is-zero-trust...

Zero trust protects the servers, not the network, and not the data.

Protecting the data means encrypting it (which Google also does) such that the client needs a key to decode it.

But if the client is hacked, the hacker can get their keys! so encrypting the data isn't a magical cure-all.

https://cloud.google.com/beyondcorp

If hacker hack your systems, they get the decryption keys too. They just might need to hit two separate targets with two attacks or a attack that both are vulnerable to.

In many cases you don't want to let an hostile party read confidential data, and if he takes control of the machine aren't all bets off?

Moreover what if a hostile party constantly hammers-disrupts your IT, letting you teams "rebuild and reload" 24 hours/day (in other words you don't have any information system anymore)?

I think the idea is that after you get compromised, you do forensics to address the vulnerability that exposed you, then after addressing the fixes in your perimeter, you reset the compromised systems. The attacker wouldn't be able to hammer you again without having another vulnerability in that case

I have never understood this; the whole Enterprise™ security business talks about all these things where half the time I literally don't even know what they're on about. They all seem to take it very serious; great! And at the same time they miss basic stuff like, I don't know, subscribing to Apache struct release mailing list. Or not keeping employee credentials around on public servers used to file credit disputes. Or in the case of Solarwinds not using "solarwinds123" as a password (probably not used in the hack, but still).

None of this is rocket science and these people probably aren't stupid, so somehow, somewhere, something is going horribly systemically wrong (incentives? Training? Organisation? I don't know).

Seems like kind of a corporate/organizational culture thing. Imperfectly distributed knowledge, hierarchical decision-making in groups with misaligned incentives, the limitations of communication and the capacities of individuals... These and more make it hard to operate a large enterprise intelligently and cohesively, and oversights will happen. Corporations can certainly seem to act dumb or just learn slowly as a whole, regardless of who they're made up of. If you go bigger and look at nation-scale, the same problems are present on a greater level.

Humans can't get this stuff right every time either.

It's not like Colin Percival or Theo de Raadt , perfect as they are, could just audit and secure all of the Fortune 500.

ISC² has done so much damage to the industry via enabling the fallacy of appeal to false authority it is mind-blowing. The cissp is such a terrible proof of whether someone knows anything, everyone knows it, but for some reason people keep falling for it.

I view it as a shared level of baseline knowledge that helps with conversation. If I see someone has it, it at least tells me they understand the words I’m using and have a basic knowledge of the concepts we are discussing (or should, at least). It also tells me they are good at taking tests.

It doesn’t tell me whether they understand how it all works together, or if they understand the organization’s environment, or if they are a good worker.

I don’t hold it against people who fail (I’ve seen good people fail the test) or who don’t have it - I just have to ask a few more probing questions to ensure they know the tech I’m discussing. But I don’t outright ask if someone is a CISSP, so typically I ask the clarifying questions anyway so our understanding of the problem is accurate and aligned.

And cert or not, I’m still more interested in whether you know what you’re doing than what you put on your resume.

I wish that were true (genuinely, a shared vocab would be super useful). I've heard so many nonsensical things from CISSPs, I should really start a parody Twitter account. Did you know, for instance, that SSL is an important control for preventing SQL injection? How about that salting is not effective against rainbow tables because of the birthday paradox (yes that's actually what they said).

It's just a cram-and-forget vocab test, it doesn't mean anything other than that they could afford the training and the test.

Sounds like it's a test in Security Fluency, not Solution Providing.

Fun fact: the word “security” comes from the Latin word for carelessness - “securitas.” se = without, curitas = care.

That actually makes sense to me. If I feel secure, I feel carefree. Maybe there should be a different word when providing a secure environment from the word where people enjoy that secure environment.

I wonder if the Swedish security company "Securitas" knew this when changing name.

https://en.m.wikipedia.org/wiki/Securitas

I’ve often wondered this. I see them around a lot, and I’m like “someone doesn’t know their Latin.”

"Centralized hosting and management (SaaS, PaaS model) has the advantage of security at scale."

it follows that

"Centralized hosting and management (SaaS, PaaS model) has the advantage of insecurity at scale."

Can you explain more about the ‘root ash’ issue please?

By using some of these tools they are under the false assumption that things that are otherwise considered security threats are somehow okay because for example the tool rotates passwords for you. It gives a false sense of security and allows you to do things that would otherwise be considered security threats.

It's as if someone sells you a laser that shoots intruders and tells you, you can leave the front door open from now on, but that laser only works 1 in 3 times.

I see so if people have cyberark they might feel like it’s safe to enable root logins over ssh? That does sound like the sort of thing that would happen.

Reply on news.ycombinator.com