351–360 of 514 posts
Really good thread here: https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransom... When these things happen, I feel like there's a predictable response. A few smaller vendors (above, Huntress Labs) provide a great running commentary. Then two weeks later, the dust has settled, everyone's patched, and I'll start receiving sales calls from Enterprise Vendor X wanting to talk about how they were all over it.
Earlier quoted context omitted.
>You clearly have no clue how it looks inside the board rooms and executive offices of some of these huge companies. This type of stuff is treated the exact same way as if a 400m building burns down. I sit with CISOs daily discussing this stuff. $400m expenditures is enough to scare the shit out of them. A $400m building burning down would have CEOs fired (see: Equifax CEO being fired after breach). I don't know what…
Equifax’s stock is up 50% from a year ago. I’d say this hack did nothing bad for their stock.
Honestly, I think this should be the death knell of these "remote monitoring and management" tools that have extreme low-level access to networks and systems, but just like the SolarWinds attack, it feels like these are run by companies with extremely poor security culture. I mean, I'd be willing to trust security to Microsoft or Apple (I mean, at some level, you've got to trust the OS). But giving the keys to the ca…
The interesting part about last year's incidents of solarwinds, fireeye and fortinet is that there's a switch away from actually targeting the hosts after the first line of defense. Redteams / hackers now target the infastructure, because it's way easier and they're more outdated in regards of code, stability and used libraries. Most enterprise-grade VPN solutions still use OpenSSL from decades ago, and most of their…
Earlier quoted context omitted.
It's almost as if making shareholder returns and CEO pay the only indicator of company success creates terrible consequences.
Long term shareholder returns are directly correlated to the long term company success. It's always such an odd criticism to think of "shareholder returns" as a pejorative.
Earlier quoted context omitted.
Would you rather have a government agency assign credit scores? The abuses would be rampant. Right now there is one party openly pushing to restrict voting access to people who are likely to vote for the other party, and a few years ago that same party enacted a new tax code that almost surgically penalized the residents of states that supported the other party; do you really trust such politicians to set up a fair c…
Then why is the SEC public, it could arbitrarily issue fines and fuck with the share price of any company that didnt donate to your party, maybe it should be private too?
It is also worth pointing out that both the credit ratings and audits of publicly traded corporations are conducted by private-sector companies, not government agencies. The SEC's primary role is to ensure that the rules are being followed, which is a straightforward law-enforcement/regulatory role that makes sense for a government agency.
I think this should be the death knell of cryptocurrencies. Or at least exchanges that allow the exchange of them for fiat.
I feel like this is a bold claim. I understand this to mean that you assume without crypto there would be less of a way to get payed for attacks like these? Or am I missing something here. Also, Do you have an evidence to support the argument: Crypto has increased cyber crime? (I hope that is an acceptable parse of your sentiment)
After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if you can weather the storm, over the course of a year or two, there is effectively zero impact to your bottom line. You can also see this in the Solarwinds stock price. Year over year, they are down a hair under 4 percent... After being directly responsible for…
> like fines and people going to jail for negligence Being bad at your job is not negligence, nor is underestimating the threat. It’d be nice to see consequences but I really don’t want to have the government locking people up for being well-paid fuck-ups. Don’t some of these companies have… shareholders?
It's quasi-monopolistic. It has the same problems : nobody gives a flying furry about actual performance.
Earlier quoted context omitted.
It's almost as if making shareholder returns and CEO pay the only indicator of company success creates terrible consequences.
Long term shareholder returns are directly correlated to the long term company success. It's always such an odd criticism to think of "shareholder returns" as a pejorative.
These kinds of games, and the all-nighter / weeks long nightmares they cause, make me want to leave this industry. We set up software on a lot of machines and then we answer a million ridiculous user questions until we finally resort to installing remote access so we don't have to stay up all night telling people what to type into a command line. Then the remote access gets hacked en masse. I'm pretty much at the poi…
> I'm pretty much at the point of thinking people need to learn how to write on paper and whiteboards again. Health IT here: won't happen. You need your CT NOW. The patient is about to be opened. There is no time to wait for the printer and it's Sunday night. The radiologist is at home examining the data while the scanner runs. And man...security is so bad and it's so hard to convince management to invest into proper…
These kinds of games, and the all-nighter / weeks long nightmares they cause, make me want to leave this industry. We set up software on a lot of machines and then we answer a million ridiculous user questions until we finally resort to installing remote access so we don't have to stay up all night telling people what to type into a command line. Then the remote access gets hacked en masse. I'm pretty much at the poi…
> We set up software on a lot of machines Windows, right?