Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Cities Strain to Fight Hackers

wsj.com

Post reply on HN
Print view View original

91–100 of 119 posts

Re: U.S. Cities Strain to Fight Hackers

#91

Post by [deleted] »

nradov wrote: post #90
peterwwillis wrote: post #68

Earlier quoted context omitted.

Do you know how many versions of how many operating systems across how many different platforms and products my company uses? Hundreds of variations, maybe thousands. Only a few groups have a solid handle on regular patching, and that's because of how hyper-standardized their systems are. Even if an OS has automatic patching, you can't just immediately apply patches without going through an SDLC and QC process. And n…

That approach might have made sense 10 years ago but it's no longer tenable now that the threat environment has escalated. Organizations will now have to roll out patches immediately even at the risk of disrupting mission critical operations.

[deleted]

Re: U.S. Cities Strain to Fight Hackers

#92

Post by txcwpalpha »

nradov wrote: post #88
didericis wrote: post #78

Earlier quoted context omitted.

Agreed. HIPPA is not exactly a promising precedent. Regulation would almost certainly lag at least a couple years behind and end up making software and IT maintenance much more expensive without making it that much more secure. I don’t think I like this idea, but imagine if marketers for more robust, secure IT solutions were legally allowed to show you how they can spy on you as a part of an ad. That opens up a huge…

What is your concern with HIPAA? There have been occasional breaches in covered entities, but overall the rules have significantly improved security and privacy in healthcare.

I spent years as a infosec consultant specialized in major healthcare companies, and my experience is completely the opposite. It is absurdly easy to be 'compliant' with the HIPAA security rule yet still have abysmal security.

The biggest issue IMO with the HIPAA SR is that it is first and foremost a legal matter that involves legal teams, and is not very good at being a technology matter that effectively prescribes security to security teams. Most of the HIPAA-motivated companies I worked with spent more effort getting their legal counsel to build a HIPAA litigation shield (via intercepting and carefully massaging the wording of security assessments) than they did getting their security teams to actually improve anything.

I did have some clients that saw HIPAA as only a foundation and guidelines for truly improving their security, but that was more a matter of the company actually caring about security, and not because the HIPAA security rule is actually effective.

Re: U.S. Cities Strain to Fight Hackers

#93

Post by bytematic »

javagram wrote: post #26

These type of organizations probably need to be running all chromebooks with a G Suite enterprise account (configured to require all employees to use 2FA). Something that has way less attack surface than what they have now.

Imagine getting/teaching them to use G Suite accounts, something I've attempted once. I thought it would be the easiest possible transition

Re: U.S. Cities Strain to Fight Hackers

#94

Post by nradov »

txcwpalpha wrote: post #92
nradov wrote: post #88

Earlier quoted context omitted.

What is your concern with HIPAA? There have been occasional breaches in covered entities, but overall the rules have significantly improved security and privacy in healthcare.

I spent years as a infosec consultant specialized in major healthcare companies, and my experience is completely the opposite. It is absurdly easy to be 'compliant' with the HIPAA security rule yet still have abysmal security. The biggest issue IMO with the HIPAA SR is that it is first and foremost a legal matter that involves legal teams, and is not very good at being a technology matter that effectively prescribes…

There will always be some organizations that do the minimum necessary to check some sort of "compliance" checkbox. However you can't deny that overall the healthcare industry as a whole has better security and security controls than they would if HIPAA had never been enacted.

Re: U.S. Cities Strain to Fight Hackers

#95

Post by elipsey »

How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process.

Also, in my experience working for state government, engineers were considered a waste of money. Hiring was difficult because they wouldn't pay anywhere close to the market rate, and techies weren't allowed to earn more then managers. There was a parade of sales people pitching the director to lay off the devs and outsource everything, and then pat each other on the back for "slashing government waste." It seems like most of their apps should in principal should not need to have been completely reinvented from scratch, but having people who don't work here responsible for security causes an agent-principle problem; from the point of view of the contractors who don't care about your security and the bureaucrats who don't understand it, everything except management is just a cost center.

If you do manage to fix anything, the new director will throw it away and start over with a new vendor contract next election. Also, if you are paid by the gvt and are not a cop or a politician, you will be despised as a "useless feeder" and face the risk or furlough, de-funding, re-org, hiring freezes, etc, that make it hard to reliably get anything done.

If the public doesn't want a public sector, why fight them by trying to work there?

I think Schneier was right to point out that security is an economic externality, and that a high level political solution is likely necessary.

https://www.schneier.com/essays/archives/2007/01/information...

EDIT: A couple of people here have pointed out that a "cyber" insurance industry is emerging. I find this encouraging because it at least seems possible for that to be a politically acceptable mechanism for pricing security; your premiums could be contingent on compliance as determined by the insurer, who has skin in the game to understand security and hire real professionals as auditors. I'm not sure how that translates to actually fixing security, but it seems like a start.

Re: U.S. Cities Strain to Fight Hackers

#96

Post by BowBun »

elipsey wrote: post #95

How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process. Also, in my experience working for state government, engineers were considered a waste of mone…

100% agreed. I've always found it very ironic that governments want the best and brightest when they never pay market rates. Not only do they want the best and brightest, they want them to selflessly serve their country at the cost of financial advancement. Is it surprising that they end up getting the lower end of the crop?

https://18f.gsa.gov/ was a fantastic move and exactly what we need. Unfortunately, it took a group of extremely successful private sector individuals to give up their careers temporarily in pursuit of fixing something.

Re: U.S. Cities Strain to Fight Hackers

#97

Post by packet_nerd »

kryogen1c wrote: post #16
testvox wrote: post #8

Earlier quoted context omitted.

But those things can be done without putting sensitive information on the internet. Crypto currency transactions can keep everything sensitive off the network. A one way airgap is indeed all you need (your device should be able to push data to the network but never receive any data from the network). The same scheme works for voting.

> A one way airgap is indeed all you need This is an oxymoron. If something can communicate, even only in 1 direction, its not airgapped. Furthermore, theres no such thing as 1-way communication. Any DB that houses info can only provide it in response to a query.

> theres no such thing as 1-way communication

It's called a data diode.

https://www.opswat.com/blog/why-data-diodes-are-essential-is... https://en.wikipedia.org/wiki/Unidirectional_network

Re: U.S. Cities Strain to Fight Hackers

#98

Post by elipsey »

BowBun wrote: post #96
elipsey wrote: post #95

How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process. Also, in my experience working for state government, engineers were considered a waste of mone…

100% agreed. I've always found it very ironic that governments want the best and brightest when they never pay market rates. Not only do they want the best and brightest, they want them to selflessly serve their country at the cost of financial advancement. Is it surprising that they end up getting the lower end of the crop? https://18f.gsa.gov/ was a fantastic move and exactly what we need. Unfortunately, it took a…

Thanks, that's an interesting story, and a cool idea. My experience was before I got to SF, so there was really not a lot of local talent around.

I was an intern back then, and I liked my boss and my team, and what we were working on. I got an offer for a mid-level position, but I went elsewhere partly because of the apparent instability.

Re: U.S. Cities Strain to Fight Hackers

#99

Post by tedunangst »

peterwwillis wrote: post #81
throw0101a wrote: post #74

Earlier quoted context omitted.

> Do you know how many versions of how many operating systems across how many different platforms and products my company uses? What OSes besides Windows, macOS, Linux, Solaris, AIX, HP-UX, z/OS, mobile (Andriod, iOS)? SCADA stuff perhaps? And how many of those operating systems are targeted by worms and ransomware? I know when I used to admin Solaris and IRIX machines we were worried a lot less about attacks than th…

Let's imagine just one example of patching a remote hole in a Windows server. First, you have to stage a duplicate of an old server with a new patch, which can take days. A production environment may need significant development effort just to integrate the patch, which takes days. Then run all tests and QC processes against it, which can take days. Then you can deploy it during a maintenance window. This is 1-2 busi…

Perhaps the city of Baltimore should have considered this before deploying thousands of different server configurations.

Re: U.S. Cities Strain to Fight Hackers

#100

Post by tedunangst »

elipsey wrote: post #95

How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process. Also, in my experience working for state government, engineers were considered a waste of mone…

Just as there's no time to do it right, only time to do it over, there's never money to do it now, only later.
Post reply on HN