Hacker News Reader

Comment by semicolon_storm | Hacker News Reader

In security, industry standard seems to be about the same as military grade: the cheapest possible option that still checks all the boxes for SOC.

View on HN

Military grade has different meanings. I’ve worked in the electronics industry a long time and will say with confidence that the pcbs and chips we sent to the military were our best. Higher temperature ranges, much more thorough environmental testing, many more thermal and humidity cycles, lots more vibration testing. However we also sell them for 5-10x our regular prices but in much lower quantities. It’s a failed meme in many instances as the internet uses it though.

Basically, whatever the liability insurance wants for you to be in compliance, than that’s the standard.

Hot take, this is the way it should be. If you want better security then you update the requirements to get your certification.

Security by its very nature has a problem of knowing when to stop. There's always better security for an ever increasing amount of money and companies don't sign off on budgets of infinity dollars and projects of indefinite length. If you want security at all you have bound the cost and have well-defined stopping points.

And since 5 security experts in a room will have 10 different opinions on what those stopping points should be— what constitutes "good-enough" they only become meaningful when there's industry wide agreement on them.

Yep. And worse, now matter how much you pay for security it is still possible for someone to make a mistake and publish a credential somewhere public.

This ^

We can’t all have the latest EPYC processors with the latest bug fixes using Secure Enclaves and homomorphic encryption for processing user data while using remote attestation of code running within multiple layers of virtualization. With, of course, that code also being written in Rust, running on a certified microkernel, and only updatable when at least 4 of 6 programmers, 1 from each continent, unite their signing keys stored on HSMs to sign the next release. All of that code is open source, by the way, and has a ratio of 10 auditors per programmer with 100% code coverage and 0 external dependencies.

Then watch as a kid fakes a subpoena using a hacked police account and your lawyers, who receive dozens every day, fall for it.

There never will be an adequate industry-wide certification. There is no universal “good enough” or “when to stop” for security. What constitutes “good enough” is entirely dependent on what you are protecting and who you are protecting it from, which changes from system to system and changes from day to day.

The budget that it takes to protect against a script kiddy is a tiny fraction of the budget it takes to protect from a professional hacker group, which is a fraction of what it takes to protect from nation state-funded trolls. You can correctly decide that your security is “good enough” one day, but all it takes is a single random news story or internet comment to put a target on your back from someone more powerful, and suddenly that “good enough” isn’t good enough anymore.

The Internet Archive might have been making the correct decision all this time to invest in things that further its mission rather than burning extra money on security, and it seems their security for a long time was “good enough”… until it wasn’t.

> since 5 security experts in a room will have 10 different opinions

If that happens you need to seriously rethink your hiring process.

Checking the boxes for SOC is a lot more than most places do, does IA have SOC compliance? I doubt it.

Reply on news.ycombinator.com