Unleeeeessssss you are a bank.
The costs of intrusions against financial institutions are seldom fully understood by people outside the industry but represent a lot of ongoing costs.
Sad reality: It's cheaper to get hacked than build strong IT defenses
51–60 of 117 posts
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#52Why is that "sad"? Nature has gone the same path. We have basic defenses that are "on" all the time (passive immune system - nonspecific), and we have an adaptive response that reacts to what actually happens to us, which also means threats we actually encounter will be recognized and fought more quickly and better in the future. Or houses - having lived in the US, those front doors are at least an order of magnitude…
Because attacks in software are always getting better, not worse. If it's a smaller company it's a shame - many of them simply don't have the resources to dedicate to properly hardening themselves against attack, and it can destroy their company. Places like Yahoo have no such excuse.
I ran an unsuccessful game service for a while, and due to the nature of our product (custom 3D characters) we suspected to receive and did receive an incredible number of hack attempts for a pretty much unknown web service. Expecting the issue, we got a US $20K SonicWall hardware firewall of the class used by banks. Best investment ever. On four separate occasions we had DoS attacks that the SonicWall shrugged off without a sweat. Typically, we'd see 100-300 actual hack attempts per day for this unknown service. To handle this, it takes is being serious, and listening and following your security experts guidance without cutting corners. They are aware security is expensive and have already mentally scaled their recommendations to a balance between what they think you can afford and security you'll need. Go with their recommendation - they are the expert.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#53I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.
You wouldn't say the same about a deadbeat teenager who smashes a car window and grabs someone's purse. "It's not because they're criminal masterminds, it's because of poor car defense."
Locks, physical and mathematical, are for the deterrence and convenience of the generally honest. Law enforcement, as an active defense, is for the deterrence of the actively attacking. At some point you're always going to have to stop turtling and build an army.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#54I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.
It's not illegal to have crappy IT but it is illegal to hack or exploit a companies computer systems.
Just because there isn't a fense around an area that says no trespassing doesn't make it legal to walk through.
"But they didn't have a fense and it was easy to walk into the area."
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#55Earlier quoted context omitted.
Because attacks in software are always getting better, not worse. If it's a smaller company it's a shame - many of them simply don't have the resources to dedicate to properly hardening themselves against attack, and it can destroy their company. Places like Yahoo have no such excuse.
I ran an unsuccessful game service for a while, and due to the nature of our product (custom 3D characters) we suspected to receive and did receive an incredible number of hack attempts for a pretty much unknown web service. Expecting the issue, we got a US $20K SonicWall hardware firewall of the class used by banks. Best investment ever. On four separate occasions we had DoS attacks that the SonicWall shrugged off w…
Are you conflating DoS (something a firewall can deal with) with the kind of hacking that can penetrate a system? I'm not sure a firewall can do anything about (for example) SQL injection.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#56That is why as a sole dev I no longer offer full-stack solutions: clients simply do not want to pay for the hours it takes to keep their back-ends monitored and secured. Yet, dynamic data is mostly inevitable in any modern web solution so I am increasingly relying on BAAS providers. My gamble is that it should be easier/cheaper for BAAS providers to maintain a team of knowledgeable and experienced engineers to tend infrastructure that runs several back-ends. It seems like a natural step from hey I trust you can run my hardware take my money to hey I trust you can manage my data take my money
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#57Why is that "sad"? Nature has gone the same path. We have basic defenses that are "on" all the time (passive immune system - nonspecific), and we have an adaptive response that reacts to what actually happens to us, which also means threats we actually encounter will be recognized and fought more quickly and better in the future. Or houses - having lived in the US, those front doors are at least an order of magnitude…
Because attacks in software are always getting better, not worse. If it's a smaller company it's a shame - many of them simply don't have the resources to dedicate to properly hardening themselves against attack, and it can destroy their company. Places like Yahoo have no such excuse.
> don't have the resources to dedicate to properly hardening themselves against attack
FTFY: Don't want to consider having the resources to dedicate to properly hardening themselves against attack
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#58Earlier quoted context omitted.
I get what you mean, but poor defense ain't no excuse to hack the hell out of company, neither legally nor morally. plus i don't buy the notion that some teenager had no clue what he was doing would harm other's livehood (if yes, then he should go through psychiatric evaluation). if I don't put 3m electric fence with automatic sentry guns around my whole hypothetical house and land, does it mean everybody is automati…
I am not sure the analogy is very accurate. You do not advertise your house as a place where other people can come and freely store their valuables and then take it out as they please. If you did, there is a name for what you have built: a bank. And you can be pretty sure people then will not have any issues with whatever security measures you take. Most of all, your cost of security installation is now covered by ot…
> You do not advertise your house as a place where other people can come and freely store their valuables
A house offers protection, no doubt about it and anyone but a social recluse will potentially offer it to others, although not foreigners. You are certainly not trying to say negligence would be OK as long as it concerns foreigners.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#59Earlier quoted context omitted.
Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.
I'd say that depends on the hack. The hacks just for prestige aren't really that prevalent any more. These days it's hack for stealing creds or money or secrets or perhaps just putting ransomeware on all the comapanies systems to get a bitcoin payment out of them...
Even for prestige, is it ok for gang members to break and enter properties, even if they don't anything, for prestige? I suspect not so the same should apply.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#60I found this to be true of securing my house. I had several break ins and the total cost (mostly repairs) was still far less than the cost of installing an alarm system, to speak nothing of paying for police response to false alarms.