371–380 of 386 posts
Earlier quoted context omitted.
> do the work to expound on your claim A free market system requires protection of property rights. Arson violates property rights, and so is not free market.
What type of market is it when there is no regulation to protect rights, whether property, natural, or civil?
Rudyard Kipling explained this: --- But we've proved it again and again, / That if once you have paid him the Dane-geld / You never get rid of the Dane. --- https://www.poetryloverspage.com/poets/kipling/dane_geld.htm... . By paying, you’ve just proven that you are a profitable target to hit.
I'm from Dublin. We didn't pay the Danegeld, and in retaliation they built a city.
Earlier quoted context omitted.
I guess there's two questions: - is protecting against internal sabotage actually different that protecting against external attack. I don't think it's all that different. It comes down to authenticating actions and enforcing the principle of least privilege. If you built a system that was actually secure (i.e. one that depends on reasonable inconveniences, rather than one that depends on people to be perfect all the…
> Most people probably aren't inclined to deliberately target their own company. It's far more likely that there is a bad actor in the world who wants to target your company, than that there is in your company. “Most” people are law abiding. So, I agree with the first sentence. The second sentence, however, has little support. The universe of people who can do these types of attacks is large, but not universal. You n…
Your argumentation doesn't challenge the truth of falsity of the statement, nor does it go towards challenging my conclusion. It seems to assume I've said "there are probably no internal bad actors", when I've said "securing your system against external bad actors will deal with the cases more likely to occur, and will usually be sufficient against the less likely cases".
'X is more likely than Y and preventing X mitigates Y to a tolerable level' is not equal to saying 'Y probably doesn't happen'.
> How many disgruntled people pass through the FAANGs each year? Now add in all the IT positions at the banks.
Obviously the probability increases significantly with the number of employees, but I don't think that switches the probabilities. Still, the most important companies to consider are the companies which, unlike FAANGs, aren't really in a position to make independent judgement about their risk profile, but whose existence depends on their records/data. And even someone with as many employees as the US government probably has more people outside of their employ who want to target them than inside, although surely they always have some of both.
I'm not sure what the relevance of your reference to computer skills is. In order to ransomware a company, as far as I know, you need to buy software off the darkweb and run it from a vulnerable location. I suppose technically that requires computer skills, but it's surely not what you mean. And the companies which are vulnerable to ransomware are not all employers of significant numbers of technically skilled people.
In any case, I don't think even a gratuitous reevaluation of the probabilities significantly changes my conclusion. Even if we assumed the improbable notion that every single company in the word has a disgruntled employee and that there are no external crooks, the process of securing the system against external crooks will make it far more survivable against single internal bad actors, and the effect it has on the employees will be less likely to produce internal bad actors.
Earlier quoted context omitted.
I'm from Dublin. We didn't pay the Danegeld, and in retaliation they built a city.
Could you explain that a bit? :o
I was just throwing some complexity into the Danegeld narrative.. not sure what it means in terms of the metaphor. Maybe ransomware hackers eventually build operating systems?
Earlier quoted context omitted.
> Most people probably aren't inclined to deliberately target their own company. It's far more likely that there is a bad actor in the world who wants to target your company, than that there is in your company. “Most” people are law abiding. So, I agree with the first sentence. The second sentence, however, has little support. The universe of people who can do these types of attacks is large, but not universal. You n…
> The second sentence, however, has little support. Your argumentation doesn't challenge the truth of falsity of the statement, nor does it go towards challenging my conclusion. It seems to assume I've said "there are probably no internal bad actors", when I've said "securing your system against external bad actors will deal with the cases more likely to occur, and will usually be sufficient against the less likely c…
The entire issue just leaves me with a nagging feeling that something fundamental is being overlooked. There is something profoundly different in modern companies that didn’t exist a few years earlier; namely, a very tight concentration of data/ops/control. Whether it’s external or internal, it seems a single person can do catastrophic damage to the company AND the customers. Fifty years ago, for instance, in a typical auto plant, I doubt a single person could have truly devastated the company (short of a bomb or arson or something). Nowadays, we’re moving towards systems where not only could a single bad actor cripple the company but also cause all the cars already sold to stop. (I exaggerate a bit, but you get my point I hope... )
Earlier quoted context omitted.
If only organizations would backup their own data. Then they could just restore and avoid paying. I have a backup device of my own at home and that's the one I have to use. The company I work relies on some MSFT service that is pretty inflexible and won't back up the entire machine.
If only organizations would backup their own data. Then they could just restore and avoid paying. This is commonly suggested, and entirely useless. What the ransomware groups do is put a time bomb on the computer, then leave it to trigger on a future condition. Your backup will backup the time bomb, and the second you restore it, it also goes boom. And therefore your backup is a perfect copy of your data but entirely…
Earlier quoted context omitted.
Notice the previous comment about developers not allowed to be admin of their own machines? On computers with a good security model developers don't need to be admin of their own machines, but that wasn't thought of.
I don’t get the point of not allowing administrator to the local machine to employees. The local machine is practically a throwaway in my opinion. Why should we care about it? The shared folder is much more vital to the business.
Locking down admin access is less about protecting the local machine and more about preventing the laptop from becoming a jumping off point into more important pieces of infrastructure. It's by no means fool proof, but it adds another security feature that has to be countered.
I don't know whether it's worth the trouble it creates, but I don't think it's totally without justification.
Earlier quoted context omitted.
Crypto can work peer-to-peer even with fiat echanges shut down. Sure, it would be more difficult if crypto is illegal, but I think because of the difficulty of getting it, crypto prices would skyrocket. Everyone will also move to using the privacy coins too. So, banning crypto might actually be beneficial for it as it would incentivise crypto projects to improve privacy and decentralization even more. A ban won't sto…
> Crypto can work peer-to-peer even with fiat echanges shut down. Sure, nowhere in my post do I deny that an underground market won't exist. In fact, I directly hint to the fact that it will exist. What matters for this problem is how easy it is to buy $X million worth of bitcoins for a company. Currently this is easy. If you have $X million in your bank account, you can go to one of these exchanges and buy $X millio…
Sure, there would be an initial bank runk, but a ban would also have unintended consequences such as making coins more scarce, thus unintentionally driving speculative demand and cause people to turn to the black market, especially if there are bank runs on fiat itself (I know, extremist, but you never know - I've personally eyewitnessed a national currency imploding once).
> This might even be good for cryptocurrencies as a platform
I guess we have something we agree on. Also a ban would encourage more activism and push cryptocurrencies to their full potential (of side-stepping the bans by going to fully decentralized exchanges and peer-to-peer) and weed out a lot of the snake oil in the space.
Do I see a ban to be successful for what what it intends to do? Maybe temporarily, but in the long term it will fail and backfire.
What I suspect: the first ransom was paid by insurance, therefore it didn't hurt them, therefore they didn't bother protect themselves for the second. Now just wait to see what will happen to your insurance rate after you pay the third ransom. They certainly will begin to understand the need for backups.
Relevant analysis here:
http://www.vendormanagementoffice.net/2021/06/cyber-insuranc...
Earlier quoted context omitted.
Well then, It’s starting to sound like backups aren’t what a business needs.
Backups are there to provide a business continuity in wide range of disruptions. What you want to protect your business from is up to you, but typically you need protection from all things OP mentioned.