Hacker News Reader

Comment by UI_at_80x24 | Hacker News Reader

The real takeaway from this:

Do your threat models include your staff? Of course, nobody has admin access.

Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job?

IME this is a great interview question to ask potential employers. The rabbit hole that you are required to go down will open eyes.

The answer is: you can't. But how you mitigate damage (with data silos) and engage in disaster recovery after the fact puts you in excellent condition to weather any storm.

View on HN

> IME this is a great interview question to ask potential employers.

That also sounds like an easy way to immediately exclude yourself and cut the interview short. It's sort of like interviewing someone for a security position, and them asking "by the way, what brand of locks and safes do you use, and what's your alarm company and specs?" It's not hard to see how it could be taken the wrong way, and giving information about internal security procedures (even generalities) to someone not contractually obligated to the company in some way doesn't seem a good idea to me.

We had a guy like that at my old job. He immediately made everyone suspicious. His first day, he constantly asked about security cameras, which doors were locked at night, how valuable everything was etc. He was frequently found in weird places with no explanation, seemed uninterested in anything about his actual job or even beginning to learn why he was there or what his tasks would be, and just generally gave off the vibe of 'was planning some oceans 11 shit' or something. He seemed oblivious to exactly how odd and suspicious he was being. He only lasted a few days, I'm honestly not sure why the boss kept him around that long. Nobody was impressed.

I guess my point is, if your genuine concern is security, definitely make sure you're not coming off like you're planning some grand movie heist.

He was probably one of the oddest people i've worked with, turns out nobody checked his out of province reference and when they finally did, nobody'd ever actually heard of him at his 'previous place of employment' so who knows.

Hilarious - I worked with someone in the past that was very similar. They lasted a few weeks. We ignored some yellow/red flags when hiring, so it's our own fault.

Yeah we were short staffed at the time. I don't think they were paying that much attention as long as someone seemed to check out at first glance. We want through a bunch of people that didn't last long around that time. He was probably the most memorable though.

You sure he wasn't a red teamer hired by the corp?

This is why security is an onerous black hole.

Security folks always condescendingly lambaste companies not using best practices, but security is literally the worst. It's an infinitely deep hole of money, time, and CPU cycles.

If you create a startup with security best practices you'll never get anything done because you have to build everything in a way such that you don't trust anyone, including your own staff. So now your staff have ball and chains shackled to their ankles to prevent them from misbehaving (but also preventing them from having agility).

It's 100x cheaper and easier to do the cheapest 80% of security, and then hope that you don't get exploited by the other 20%.

You say black hole, us security people call it a "hard problem".

I mean lots of IT things are or end up being black holes.

I will say though, usually, attitudes like yours end up causing more problems than they solve (casual dismissal of security in general, more of a bother, doesn't stop everyone, waste of time, etc. etc.)

I like to think of security like this: My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. Yes, black hole, but my (infinite) glass is half-full.

The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff.

Yes, I get we live in a world where bad people take advantage of others, making security necessary.

But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist.

> My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for.

By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.

Security is a trade off. Everyone knows that the most secure computer is one that you never turn on; the job of your security team is to strike a balance that is better than that.

> Everyone knows that the most secure computer is one that you never turn on

An attacker might gain physical access to your turned-off computer and wreck all sorts of mayhem (install a hardware keylogger, rip the hard drive out and recover stuff from it, etc). The most secure computer is the one that doesn't exist.

If you never turn it on, there can't be anything useful on it ;)

An attacker with physical access could install an LTE-controlled power outlet and then remotely turn it on and use it to mine cryptocurrency whenever you aren't around, stealing your electricity. Ok, maybe that's a stretch...

> the job of your security team is to strike a balance that is better than that.

There are two ways to strike a balance. A cooperative way, and a competitive way. A cooperative way is when all sides get together and hammer out an optimal solution, and then implement it in agreement. A competitive way is when everyone pushes to maximize their interest, and through the fighting, an equilibrium establishes itself[0].

I think GP is complaining about security teams that approach their job in a competitive manner, instead of a cooperative one.

[0] - You'll note that this is how competitive markets work; this both makes them a robust decision-making mechanism, and an incredibly wasteful one.

Firms in competitive markets don't fight, fighting would be if one firm's products somehow un-manufactured another firm's products. So, the defense industry, and nothing else. They hurt each other's bottom lines, but help society as a whole by collaborating to produce more of whatever it is they're selling.

> fighting would be if one firm's products somehow un-manufactured another firm's products

They absolutely do, and would do it much more if most ways of doing that weren't strictly illegal. A particularly notorious, legal way of unmanufacturing your competitor's product is when both yours and theirs rely on a common component - so you can buy out the entire supply of that component to prevent your competitor from releasing a similar product after you. Off the top of my head, Apple did that with these mini hard drives for iPods.

A more common example of fighting is advertising, which becomes a zero-sum game when the market for a product category saturates.

Startups are fine I think: in a 4~10 people company every employee is the equivalent of VP and each getting admin access to company’s DB for instance is par for the course.

If you can’t trust your CTO you have other issues at hand.

Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job?

That's precisely the hard question, but I think you can reframe that question: "How can you tell when somebody is accessing data that isn't necessary to do their job, in a given specific case?"

For example, could you correlate access logs to support tickets to make sure a support agent was only accessing sensitive data corresponding to the customer whose ticket they were working on? Could you do that in a mostly transparent way? What if the customer has to explicitly grant access before the agent can open the account for investigation? (None of these ideas are silver bullets, they're all situational possibilities.)

I don't think there are any easy answers, but I do think there's some granularity to how hard any given company finds it reasonable to try to guard against this issue at a behavioral level.

This may be a killer app for capability (security) model' approach. The "bored admin" of another comment in this thread has a 'superuser' ACL grant, and would leave auditable traces [if using] a provisionally granted security capability.

I worked on a HIPAA application years and years ago. I don't think ANYONE was above having their access logged. I'm sure banks have also solved this problem too of no-unauditable access.

Of course. But the question is if a smart, malicious, dedicated insider with a lot of privileges could find some way to access information while evading logging and covering their tracks in other ways.

The answer is definitely yes.

Though I feel obligated to add that I think the above fact doesn’t mean an organization shouldn’t try at all to protect against insider threat. Most are opportunistic, not all of the qualities you mentioned.

How hard you try depends on your company’s situation. Some industries make it more necessary than others.

Treat it like financial or banking fraud.

You can't stop someone taking it, but you can audit the hell out of it so when stuff gets misappropriated you can find out exactly who was responsible.

Then the law becomes the deterrent.

The problem with this is that first somebody has to notice.

In banking the reports will flow in quickly if somebody lost money.

In Roblox, when somebody created in-game currency out of thin air or accesses private information of other people, then chances are nobody notices and the audit logs are never manually investigated.

Doing automated audits then again brings up the question: how do you determine if something was the result of a genuine support action or fraudulent. You can try to find/train algorithms to detect that, but given that you can only train it against common fraudulent patterns, and do not know about unreported cases by the very definition, you cannot be sure such a system is operating well and/or cannot be easily gamed.

Banks have it easier in that regard, because the books have to match end of the day.

The law being the deterrent didn't really help here either. According to the article the "hacker" either bribed somebody for access, phished somebody for access or used some vulnerability to gain access. All of which isn't exactly legal, so the deterrent already did not work, tho it might make your own employees think twice about accepting bribes. But the hacker probably will not care about your audit system beyond the point of defeating it long enough to gain whatever they were out to gain.

Right because there's no fraud in the financial sector.

The last time my debit card got stolen the fraud people at my credit union suggested checking my account daily to catch it as soon as it happens again. They didn't really even expect to be able to prevent it. Or pretend like they would try.

It's apparently my responsibility to make sure they didn't just hand out some of my money to whoever walked by and asked for it. They never know exactly who was responsible because they were responsible. Of course the law doesn't see it that way.

get a real bank.

Banks don’t take more responsibility for participating in fraud than credit unions. The law puts the burden on consumers to both detect fraud and ask politely to have their money returned.

At least with a credit union the customer service is a bit better because incentives are more aligned.

Every time a friend or relative asks my opinion on some tech that involves cameras or microphones I always point this out. Usually by asking How comfortable do you feel with a bored admin watching you? How well do you think the company is monitoring it?

On top of that, how much do your personal threat models overlap with your boss's or the executive staff? How much do they trust your judgement/expertise? How well do you demonstrate judgement/expertise? If you are the executive staff, fantastic - one less thing to worry about.

You are missing some techniques there. For example, to access any production user data where I work, I have to fill out a lease form and someone has to approve it. So you can technically have no one with admin access on their own without documentation and oversight.

>>> The answer is: you can't.

Yes you can and it's almost trivial to do.

Require an active ticket to access stuff, that needs approval from a second person. For very sensitive matters (say doing large transfers in a finance/bitcoin company), make it three or more people.

On some cryptography lecture I heard that definition of a trusted party is a person that could betray your trust and expose your secrets.

Reply on news.ycombinator.com