Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Cities Strain to Fight Hackers

wsj.com

Post reply on HN
Print view View original

101–110 of 119 posts

Re: U.S. Cities Strain to Fight Hackers

#101

Post by elipsey »

tedunangst wrote: post #100
elipsey wrote: post #95

How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process. Also, in my experience working for state government, engineers were considered a waste of mone…

Just as there's no time to do it right, only time to do it over, there's never money to do it now, only later.

You have obviously worked for that state. :)

Re: U.S. Cities Strain to Fight Hackers

#102

Post by consumer451 »

AWildC182 wrote: post #87
consumer451 wrote: post #79

Earlier quoted context omitted.

> The EPA will bring suit to companies polluting illegally. Why shouldn't a government agency bring suit to companies or cities risking a leak of hundreds of millions of social security numbers, for example? Maybe at first we could try an in-between solution. I hate to water things down but maybe a scheme like a USDA Prime Beef label[0] would be more likely to actually pull off? If there was a NIST Certified logo on…

"When a measure becomes a target, it ceases to be a good measure." This sounds nice, but I can't help but feel like this could end up being abused... somehow .

I completely sympathize with that line of thought, but if I take that position to its logical ends then I find myself nihilistic.

Re: U.S. Cities Strain to Fight Hackers

#103

Post by tynpeddler »

helen___keller wrote: post #22
Kalium wrote: post #18

Earlier quoted context omitted.

Advising companies that they can and should fix things is actually the easy part. Getting things fixed in a way that makes companies happy is actually incredibly difficult . You're proposing a government agency get its hands dirty fixining thousands upon thousands of bizarro line-of-business applications and mission-critical excel macros. Convincing companies to update what they see as systems that "work just fine" t…

>Convincing companies to update what they see as systems that "work just fine" tends to be a Herculean task even when you can make a business case for taking on the expense and risk. >Telling a company "The government says you have to patch and is offering to do it for you" seems like it might not go over quite as well as you might hope. I think a better idea is to have the new agency play an advisory / supplemental…

The SEC (before it was neutered) may be a better model. It's a group of hackers that investigates government and industry infrastructure for problems. They can warn parties if they find an issue, and if the issue isn't fixed, this group could bring civil, and maybe even criminal, proceedings against the parties.

Re: U.S. Cities Strain to Fight Hackers

#104

Post by velp »

tedunangst wrote: post #99
peterwwillis wrote: post #81

Earlier quoted context omitted.

Let's imagine just one example of patching a remote hole in a Windows server. First, you have to stage a duplicate of an old server with a new patch, which can take days. A production environment may need significant development effort just to integrate the patch, which takes days. Then run all tests and QC processes against it, which can take days. Then you can deploy it during a maintenance window. This is 1-2 busi…

Perhaps the city of Baltimore should have considered this before deploying thousands of different server configurations.

But having so many configs is security in and of itself! /s

Re: U.S. Cities Strain to Fight Hackers

#105

Post by didericis »

nradov wrote: post #94
txcwpalpha wrote: post #92

Earlier quoted context omitted.

I spent years as a infosec consultant specialized in major healthcare companies, and my experience is completely the opposite. It is absurdly easy to be 'compliant' with the HIPAA security rule yet still have abysmal security. The biggest issue IMO with the HIPAA SR is that it is first and foremost a legal matter that involves legal teams, and is not very good at being a technology matter that effectively prescribes…

There will always be some organizations that do the minimum necessary to check some sort of "compliance" checkbox. However you can't deny that overall the healthcare industry as a whole has better security and security controls than they would if HIPAA had never been enacted.

I’m not sure if we can really confirm HIPPA’s effectiveness that readily; we don’t live in a non-HIPPA world, so we can’t compare the outcomes.

If hospitals faced zero consequences for losing customer data, then yeah, things would probably be worse. But HIPPA is two things: a set of mandatory requirements and a grounds for suing hospitals that lose/misuse data. I think the latter thing is effective, but the former is not.

Re: U.S. Cities Strain to Fight Hackers

#106

Post by darkpuma »

gabriel-uribe wrote: post #86
darkpuma wrote: post #44

Earlier quoted context omitted.

> "we want [...] to be able to vote electronically etc." Speak for yourself. I see no upsides.

Wouldn't increasing voter turnout be an upside? Reducing the loss of productivity of those participating? Voting electronically is dangerous today, but I still see it as something to work towards. However, I imagine that would require incredible innovation towards multiple layers of robust identity verification protocols.

> "Wouldn't increasing voter turnout be an upside?"

There are better, less drastic, ways of making voting more accessible. Washington state's system of mailing everybody a ballot works pretty well. I usually don't even remember when elections are coming up until I get a ballot in the mail, without ever asking for it. In Washington, people who care to vote don't have any trouble finding the time. (Of course many people just don't give a shit, and electronic voting won't change that.)

Re: U.S. Cities Strain to Fight Hackers

#107

Post by gist »

oldjokes wrote: post #6

Replace "cities" with "any organization that is not tech first" and you'll still find hundreds of win 7/vista/xp machines that have never been patched, and ad-hoc network closet/cloud hybrid rigged solutions for everything. There is literally no way to fix all this dumb fragile infrastructure without a massive government program that accepts responsibility for doing so. You need thousands of smart people going throug…

> You need thousands of smart people going through every machine, all the software, all the systems. These people are never going to work for Baltimore or for Maersk, not in a million years.

I love this assumption that anyone smart or anyone good would automatically be working for another company or at another job. Not only is that just screwy off the top (assumes that smart people automatically can move and relocate to the most desirable job - even geographically) but it also assumes that anyone with any skills would never ever work in that type of situation to begin with. [1] Maybe there are good people that are working there but a government situation like the city of Baltimore is not chock full of the type of money required to actually fix a problem like that or ever Maersk management does not view it as a priority in any way. You know not every job is in a startup that has been VC funded and can afford to lose money ditto for a traditional company such as Maersk. Noting of course that the 'best and the brightest' that work for some of the 'top companies' are kind of screwing up frequently. Not to mention MSFT 'top' designed much of this hackable code at one point.

[1] Attorneys are often like this as well the halo of a top firm means if you are operating out of a storefront you must be stupid in some way otherwise you'd be working at one of the top shiny law firms.

Re: U.S. Cities Strain to Fight Hackers

#108

Post by Kalium »

nradov wrote: post #94
txcwpalpha wrote: post #92

Earlier quoted context omitted.

I spent years as a infosec consultant specialized in major healthcare companies, and my experience is completely the opposite. It is absurdly easy to be 'compliant' with the HIPAA security rule yet still have abysmal security. The biggest issue IMO with the HIPAA SR is that it is first and foremost a legal matter that involves legal teams, and is not very good at being a technology matter that effectively prescribes…

There will always be some organizations that do the minimum necessary to check some sort of "compliance" checkbox. However you can't deny that overall the healthcare industry as a whole has better security and security controls than they would if HIPAA had never been enacted.

High-quality regulatory regimes are ones where bare-minimum checkbox-driven compliance yields good-enough results. Low-quality ones resemble kabuki, which I've personally witnessed in companies doing PCI self-certification.

Re: U.S. Cities Strain to Fight Hackers

#109

Post by mycall »

oldjokes wrote: post #6

Replace "cities" with "any organization that is not tech first" and you'll still find hundreds of win 7/vista/xp machines that have never been patched, and ad-hoc network closet/cloud hybrid rigged solutions for everything. There is literally no way to fix all this dumb fragile infrastructure without a massive government program that accepts responsibility for doing so. You need thousands of smart people going throug…

Most enterprise hacking come in through emails. Should NSA deliver SPAM to make this happen? idk

Re: U.S. Cities Strain to Fight Hackers

#110

Post by closeparen »

peterwwillis wrote: post #68
throw0101a wrote: post #60

Earlier quoted context omitted.

> Security is just hard, and it's not easier just because you're a tech company. We're not talking about everyone having Red Teams here. We're talking about keeping up to date with regards to Patch Tuesday, or even just having an OS that still actually gets patches. That'll get us 80-90% of the way to decent security: > “Almost two months passed between the release of fixes for the EternalBlue vulnerability and when…

Do you know how many versions of how many operating systems across how many different platforms and products my company uses? Hundreds of variations, maybe thousands. Only a few groups have a solid handle on regular patching, and that's because of how hyper-standardized their systems are. Even if an OS has automatic patching, you can't just immediately apply patches without going through an SDLC and QC process. And n…

The attacker isn’t going to follow your SDLC and QC processes.
Post reply on HN