Hacker News Reader

Comment by xg15 | Hacker News Reader

Yeah I guess then we can just shrug and go on because there is nothing we can do to stop our app from randomly breaking tomorrow.

> So the only practical way to stay secure-ish is to reactively patch software as vulnerabilities are publicly discovered.

But this is different from just blindly accepting any update that upstream gives you.

> And also defence in depth.

This sounds increasingly like security theater. You can always more layers obstacles to make things harder for malware that is already on your system, but it's not clear to me how much this actually reduces your atrack surface.

View on HN

> This sounds increasingly like security theater.

It does help. Quite a bit.

Each layer (e.g. firewall rules that require that all internet access go through a proxy), adds non-trivial amount of work for the hacker to get anything useful done.

1. best case - hacker will give up.

2. good case - you have more time to notice and react.

How much layer cost you, how much does it cost for hacker to overcome it.

Things to remember:

1. Not all hackers are nation states. Most are not.

2. We must accept that no security measure is absolute even against script kidies. Given enough time and luck/misfortune js sandbox will do "rm /sensitive/file".

Recent Log4shell example shows that one can follow all best practices and still get bit in unexpected way.

Defense in depth implies a whole lot of things, and is certainly not security theater. Usually it boils down to three major themes:

1. Reduce blast radius: assuming component X is compromised, how far and wide can it be felt?

2: Principle of least privilege: once compromised, what can X do or access? Extend to the credentials X carries or has access to.

3: Detection: how early and how well can you detect the compromise in previous two steps?

You can never prevent a compromise, but you can make it easier to notice when it has happened, and you can limit what the attackers can do afterwards.

Reply on news.ycombinator.com