91–100 of 114 posts
The JPL does much more interesting stuff than just NASA, like engines for military and also secret SW programs for the NSA (we know that from Larry Wall who was sysadmin there). And they are just administered by Caltech staff. Whow.
Random hackers are only interested in confirmation of aliens, but NSA or DOD stuff is very, very interesting to the Chinese who hacked these systems last.
I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There were several problems: the inventory tracking issue was particularly enlightening: >system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators respon…
This is expected. Any manual work will have errors and lots of them. If you want a system to be robust, you have to engineer it in a way it stops working if one of the prerequisites aren't satisfied. It's costly but there's no way around it afaict. In this case, you wouldn't allow a device to access any information on the network without a proper certificate. The public systems need to learn from private companies in…
Combine that with security keys, and you're in a decent spot.
I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There were several problems: the inventory tracking issue was particularly enlightening: >system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators respon…
Most corp IT teams I have encountered used some sort of proprietary system for tracking inventory or other management activities. I wish there were robust open-source software stacks available to manage corp IT stuff. Also, I find it weird to let 3rd-party closed source network appliances (security scanners etc) to be simply plugged into your network and wait for them to produce reports.
I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There were several problems: the inventory tracking issue was particularly enlightening: >system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators respon…
Lack of training doesn't matter at all. This is just a mechanism to blame people, it doesn't ensure security at all.
And of course JPL doesn't have a mechanism to allow DHS to scan its entire network. Nobody has a big red button that says "please provide a back door in every single security policy we have for one party to do whatever they want".
This whole report is bullshit designed to place blame. Why is anyone taking this seriously?
I remember back in the late 80s telnetting out of the NYU Bobst library on their VAX 11(?) system to some pretty interesting systems. The Johnson Space Center in Houston (running VAX 11/785s was one I particularly remember. Of course, back then things were not battened down as much as they are now; the spirit was an open network. A sysadmin would interrupt your session with quesitons like "Who is this? You are unauth…
Earlier quoted context omitted.
I apply Hanlon's razor to individuals, not collective entities such as a company or agency. The behavior in recent history of such entities I think warrants the exception to the rule.
It’s a heuristic that gives you a good starting point, not some sort of law. As it stands, it’s a starting point that’s easy to back with data suggesting it is indeed the case. If you can point me towards evidence that malice is indeed the case here, I’ll willingly change my mind.
Earlier quoted context omitted.
If accepting is a no-op then you are being tracked even before you make your decision - as the page already have been loaded. A brutal violation of course but I absolutely expect that to be the case.
I leave the majority of pages that have these popups now. My (likely vain) hope is that the tracking data will show higher bounce rates, and eventually the publishers will explore better financing models. I’m not holding my breath.
Sites that don't respect their users extremely seldom have anything of quality to offer anyway.
There are probably a few dozen organizations out there that are properly implementing strong information security practices, and my hats go off to them. But they are the few, and I have never worked for one.
Despite best laid plans and policies, every place I have worked has always had some improperly secured services somewhere on their network. And every place that I've worked has had segmented networks that people end up relying on. And the people working for these organizations are often aware of the improperly secured resources, but they're only in the DMZ, and there are many other things to worry about, so it lives on.
Especially now that we live in an IPv6 world, why not just run everything publicly. Push security all the way down to the applications themselves, and rely on the software development lifecycle process to catch security issues.
Every service has to be secure. And they can get an awful lot of help in this from things like a service mesh architecture, where you're getting mutual TLS from something like Envoy, and the applications won't accept a network connection unless they're specifically authorized.
We need to stop relying on firewalls and network segmentation entirely, and just run everything on the public Internet, and make sure every service is secured.
I will say, when a zero day comes out in whatever proxy you're using to secure your services, you are in for a world of hurt. But there are zero days in firewalls too.