> "I've got a stronger password than 'solarwinds123' to stop my kids from watching too much YouTube on their iPad ... You and your company were supposed to be preventing the Russians from reading Defense Department emails!"
Words fail.
Do I think most private companies could defend against Double Dragon or Lazarus or Fancy Bear? No, if a state level adversary is attacking you and the payoff is that good, you are going to get popped.
But a strong posture makes it harder, which means they throw more at you and you have a chance of picking up on the attack. Best case, anyways. Worst case, you get to testify to Congress that your security measures were top notch and industry leading. That sounds a shit ton better than “we left a screen door open and didn’t notice for months.”
And while Russia conducted this attack, I'm tired of the Russian scarecrow: SolarWinds' job here has nothing to do with Russia.
But mostly I'm jaded by ambitious SoCal pols neglecting their districts to score easy points on national issues.
I don't think she was implying that at all. She was highlighting that if they couldn't even do a basic thing like employing stronger, more complex passwords - how could they defend against Russians reading DoD emails.
So we should assume Windows, Linux, every CDN, every major firewall, switch and router, etc. are all owned by Russia?
I mean, software is far too complicated in our current rube goldberg tower of abstractions, and the asymmetry favours the attacker (only have to be lucky once, etc).
Until a few generations have grown up with software, I'm not sure this is going to improve (although in that case, we've probably solved climate change, so that would be good).
My laptop? My OpenBSD router? Very unlikely anyone has attacked it. I’ve had boring jobs and have boring interests.
Do I think the Russians, Iranians, or any major foreign adversary have a 0-day they could use against my systems if I suddenly got a top secret clearance and clocked in as more interesting? Absolutely.
I do, however, agree with you in part: I’m sure that I have a lengthy profile built from passive monitoring. Heck, I’ve googled “tor project” so I know I’m in a database.
https://daserste.ndr.de/panorama/aktuell/NSA-targets-the-pri...
Everything is about relationships. It makes no sense to "target" someone for being suspicious up front, because when they know they are interested in you, what they want to find out is who you interact with and how. So ideally, they (any data analyst) want everybody in their database. Then they do queries when they are looking for something.
And looking at what has been public, in the news, it seems like it isn't that unusual to break into and scarf up someone else's database in its entirety, without any fancy "0-day" exploits. Case in point, the US Office of Personnel Management had everything compromised, basically all the information the US government possessed about everyone with a security clearance. Probably it will never be publicized how many spies were lost, let alone other damage.