Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

Parent Full thread

It is dazzlingly expensive to run a 500+ seat IT organization in a matter that is meaningfully hardened against attackers. Meanwhile, IT budgets are calibrated against the last 20 years of typical IT expenses. That's despite that fact that the last 10 years have drastically increased the risk of IT security attacks, because:

* the technology adoption curve of attack techniques has made powerful attacks available to the "early majority" cohort of criminals

* computer science has demonstrated flaws in foundational technology that weren't widely known 15 years ago

* as online attacks have mainstreamed, an industry value chain has developed to monetize weaknesses

So it's business-as-usual in IT, despite the fact that when it comes to security, "usual" has been redefined.

Basically no medium/medium-large company in the world is willing to spend the amount of money (and make the usability sacrifices) it would take to reasonably ensure resiliency against attacks. The most secure firms spend anomalous amounts of money simply to elevate themselves to a point where they (a) aren't the easiest targets and (b) have bought enough time to detect and respond to incidents as they occur.

It also wouldn't hurt to move away from the "network security" model to a "zero trust network" model, where each computer is secured against everyone else in the internal network, just like it would be against the Internet, and the users have very limited privileges to only allow them to do the job they are required to do.

http://blogs.wsj.com/cio/2014/04/24/google-cio-enterprises-s...

https://static.googleusercontent.com/media/research.google.c...

That's the logical extreme of the "network segmentation" bullet I listed above. The problem with endpoint security and internal trust is that the endpoints aren't the most valuable goal on the internal network; we attack them because they're pivots to internal applications, which are the most valuable goal. So making it harder to compromise an individual desktop from within an internal network doesn't really do much. Making it harder for an arbitrary desktop to reach the document management server, though, does make a difference.

If one had an infinite monetary and user acceptability/retraining budget... what would a modern, secure 500+ seat IT infrastructure look like? Even in the broadest of terms.

You would also need to ask how much the company is willing to trade off productivity for security. With enough budget, you could have security like that of any three-letter-agency, or even more draconian, but good luck getting work done, or retaining employees.

That's not to say that user data should go unprotected; the majority of people in the company should have zero access to that, such that even if their systems were compromised user data would remain safe.

* No unfiltered attachments in email, for definitions of "filter" that include "stripping out content and re-rendering in simpler formats", like "PDF->RTF" or something equally terrible.

* Fine-grained segmentation of all networks on need-to-know basis, informed by the org chart and detailed role descriptions for virtually all employees.

* No employee access to arbitrary Internet sites

* For employees that require Internet access, air gaps between computers that can hit Google and computers that can access company email

* Formal audits for minor software releases

* Expensive, heavily tested secure coding training for all developers

* Adoption of secure coding/design standards ("this is the XYZcorp way to make an SQL query" and "this is the XYZcorp way to render HTML"). Strict bans on deprecated interfaces.

* Employee access to sensitive internal applications (like document and image management) gated through Citrix-like environments, so you have to remote terminal in to get to the browser that actually talks to the application.

* Extremely minimal access provided to VPN users.

* Total 8021x-style lockdown of network ports and fascist policies against bringing own devices.

And so on.

There is zero chance this is ever going to describe any huge company.

> No employee access to arbitrary Internet sites

zomg! muh freedoms!

If I worked as a developer inside such an organisation, I'd quit. A sad side-effect of rigorous IT security is the lack of productivity and day-to-day frustrations experienced by the staff.

I've experienced this myself inside a major central bank. Most development staff were a) demoralised and b) frequently adopting insecure work-arounds.

You mean you don't want to use two entirely separate computers just so you can access email?

Paranoia in excess.

Hey, we used to use a Mac for Internet and email and a Windows machine for "work", both on the same desk.

So would I. But another way to look at this is, instead of "I'd quit", saying "they'd have to pay me 3x more to work in a place like that". At which point you can again start looking at it as an economic problem.

You're right. I work at a place that does all but two of those, and I wouldn't if they didn't pay me as much as they do!

If you work at a company with more than 500 employees that does all but two of those, I'd like to hear more about that. As I wrote those bullets, I filtered them through my experience of consulting for F500 companies, and when I found myself writing something I'd seen reliably deployed across entire organizations, I edited the bullet until that was no longer the case.

About the closest I've come to seeing any of these bullets deployed reliably is Microsoft's developer training and deprecation of the standard C library, and that initiative was so out-of-the-ordinary that it was newsworthy, and widely reported.

But to actually earn that bullet, Microsoft would need to deploy those same measures across all its contractors, and, more importantly, deploy them on internal IT and line of business systems, not just the Windows and Office codebases.

I imagine some government facilities could hit that mark—based loosely on descriptions of friends who have worked in such environments.

Bingo.

See the sibling commenter, but think government.

Plus, the posts I read earlier didn't mention 'Fortune 500' or 'reliably' - and I'm glad you didn't use words like 'productive' and 'efficient'!

I feel that the biggest thing that most companies could do to safeguard a user's privacy is to just respect it: the majority of websites that ask for an email address to sign up don't truly require it for proper functioning.

Either they need to sell my address to spammers to finance their business or they delusionally believe I want to read their spam.

> Employee access to sensitive internal applications (like document and image management) gated through Citrix-like environments, so you have to remote terminal in to get to the browser that actually talks to the application.

That may be a realistic proposal, but I'm skeptical that it's the best answer, maybe because 100% of my Citrix experiences have been awful. Wouldn't "ensure internal app adhere to all other points, rewriting them if necessary" be a better answer for "given infinite money" question?

Sure, I think you could add a bullet for "applications not gated through Citrix-like environments are written to be hardened against arbitrary client software, as opposed to the single company-spec version of Firefox that users are allowed to use in a Citrix session".

You'd still have Citrix lockdown environments for any application that you can't rewrite. For instance, an F500 might license the web app it uses for image management for things like scanned medical records.

I should add: I don't think any of these are realistic proposals.

Check with a Swiss bank. They typically spend 10% of their IT costs on security.

Swiss banks have a tradition of security overkill. Branches in nice areas have bulletproofing rarely seen in the US outside of very bad neighborhoods. It would be un-Swiss not to be prepared.

Have some experience there. Not meaningfully different from finance IT as a whole. Finance orgs generally fall under the bucket I described in my first comment here, of "spending enough not to be the easiest targets", so there's that!

> infinite monetary and user acceptability/retraining budget

In that case every employee would have one or more security people standing behind them the whole day. No email would be opened without a phone call to the sender to confirm that it's not spear phishing.

But more realistically, loads and loads of 24/7 monitoring and internal auditing and testing. Attackers have to abuse something to get in, and if the company is internally doing the same thing with a large enough team, 99% is probably secure. Hackers will probably look for easier targets then. Still, this is quite unrealistic to happen in present times.

I'd agree with everything you've written but also add that the direction that technology itself is taking (very fast adoption of new technologies, applications being composites of large quantities of 3rd party code with unknown provenance) makes it even less likely that an organisation would be able to resist modern attack methods from a focused well-funded attacker

That's a large part of what makes me no longer enthusiastic about working in the space at all.

Which, as it happens, I've rather pointedly not been.

> computer science has demonstrated flaws in foundational technology that weren't widely known 15 years ago

Can you list a few examples of such flaws?

Heartbleed and Shellshock come to mind. There have been others, and the "revelations" of NSA et al actively poking or preventing the closing of holes in all kinds of software and hardware.

Aren't these "simply" software implementation bugs? Unless I misunderstood what the GP meant by "computer science".

Ah no I think I misunderstood. tptacek replied with examples though.

Two big classes of flaws that seem new:

* Exploitable memory corruption (really only began to be recognized in late 1995, and only became mainstream with modern heap exploits, perhaps 10 years later). Really, this trend meaningfully picks up speed with the dawn of the clientside exploit era, in which we no longer obsess about Sendmail vulnerabilities and start obsessing about browser vulnerabilities. In essence: the revelation that memory-unsafe languages are insecure in the presence of virtually any defect, not merely unsafe buffer copies on the stack.

* Side channels, not so much for crypto (crypto attacks are fun but rare, and certainly not the low-hanging fruit used to compromise most networks) but for weaponization of other flaws. Side channels are the other side of the "covert channel" coin, which coin basically describes "surreptitious unintended exfiltration of data from software". So here you're also talking about things like blind SQLI.

In-band signaling and the insecurity of using simple strings to encode program behavior would be a third major class of foundational flaws, but it isn't new; it was well-known in the late 1980s. But industry certainly hasn't adapted to eliminate it; witness, for instance, very widespread Java application frameworks that embed executable server-side scripting code in UI inputs!

ROP attacks, or more specifically, that you can build an arbitrarily powerful program given only a buffer overflow to an unexecutable stack and libc.

Excellent and very succinct analysis.

Reply on news.ycombinator.com