Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Security: A pre-war reality check

berthub.eu

Post reply on HN
Print view View original

181–190 of 286 posts

Re: Cyber Security: A pre-war reality check

#181

Post by GuB-42 »

killjoywashere wrote: post #71
crocal wrote: post #9

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a sto…

Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you . https://en.wikipedia.org/wiki/Ascension_(healthcare_…

[flagged]

Re: Cyber Security: A pre-war reality check

#182

Post by qaq »

sublimefire wrote: post #55
ahubert wrote: post #3

Author here - if you have any questions, please do let me know!

As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things. Another important thing is that Microsoft helped them to fight back as well, so it was not a terrible investment. Was there any quantifiable risk assessment done to understand the potential damages if Russians carried…

I work for top tier cyber security outfit we had a sizable amount of resources allocated to helping mitigate cyber threats to Ukraine. My understanding is this is not isolated as most top tier or even smaller vendors and service providers took an active role in helping Ukraine defend against ruissian cyber attacks.

Re: Cyber Security: A pre-war reality check

#183

Post by lmz »

simion314 wrote: post #96
aizen89 wrote: post #94

Earlier quoted context omitted.

Everything you outlined applies to US politics too :DD

>Everything you outlined applies to US politics too :DD What? that Canada made an alliance with soem other neighbors so the evil USA would not invade them ?

> they think God gave them the right to dominate half of the world, they will tell it to my face that genocide my nation is not personal, it is geo politics

This part could well apply to Americans.

Re: Cyber Security: A pre-war reality check

#184

Post by toast0 »

killjoywashere wrote: post #71
crocal wrote: post #9

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a sto…

Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you . https://en.wikipedia.org/wiki/Ascension_(healthcare_…

> When the entire San Diego region lost power during rush hour for 4 hours in 2011, the cell phone system still worked. I was able to email documents to Tokyo from a car despite no traffic lights.

Around me, cell towers have 3-5 hours of battery when utility power is out. If your outage had gone on much longer, you would likely have seen cell towers start dropping out.

Of course, my area also has some other nasty SPoFs. A couple years ago, a telco cable was severed and DSL for everyone was out and at least some of the cell towers were live, but no service. A few weeks ago, the cableco had its wires severed, and cable tv and internet was offline, and so were some cell towers. IIRC, for the telco one t-mobile worked and verizon didn't, and for the cableco t-mobile didn't work and verizon did. Not sure about at&t.

Re: Cyber Security: A pre-war reality check

#185

Post by ChrisMarshallNY »

indymike wrote: post #83
killjoywashere wrote: post #71

Earlier quoted context omitted.

Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you . https://en.wikipedia.org/wiki/Ascension_(healthcare_…

> Change Healthcare has lost $872M since it was attacked in February. The question is, what is the cost to secure? I've been in so many meetings where the cost of security is 10-15x the cost of a breach. It's horrifying.

One reason, is probably because retrofitting security is a freaking nightmare.

In my opinion, security (as well as Quality, and things like error handling, accessibility, and localization) is something that needs to be planned and implemented, from Day One.

Do a better job from the start, and the cost will drop like a stone.

Re: Cyber Security: A pre-war reality check

#186

Post by dralley »

sweetjuly wrote: post #147
dralley wrote: post #122

Earlier quoted context omitted.

> As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things. It's worth mentioning that the most expensive and extensive malware attack in history was caused by one of such Russian cyberattacks hitting systems which (at the time) they weren't intended to. Causing severe shipp…

Why don't we see these attacks though? I know they're worryingly practical and the West certainly has enough enemies (especially from extremist groups who don't have the same peace keeping concerns as a nation state), and yet we don't see groups just sabotaging critical infrastructure and businesses left and right. Is it really just difficulty/a lack of skill?

I mean, we do and have, they just haven't yet been explicitly targeted at critical infrastructure. When they hit critical infrastructure, it has been more of an accident, that gets papered over by just paying the ransom (because it was a financially motivated attack) or the US government getting sufficiently pissed off to intervene directly state-to-state (which kinda happened with the Colonial Pipeline one in 2021).

If the attacks were targeted, were destructively motivated instead of financially motivated, there was no "kill switch", government threats ceased to work, etc... it'd be pretty bad.

Re: Cyber Security: A pre-war reality check

#187

Post by dralley »

cpursley wrote: post #180
dralley wrote: post #174

Earlier quoted context omitted.

This is a nonsense statement. Every poll performed on Ukrainians shows that a clear majority doesn't want elections right now, and Ukrainian law permits this during wartime. The logistical challenges are insurmountable particularly when one things about local elections. People are displaced all across the country and to other countries, soldiers that are fighting on the front lines cannot just rotate simply to be abl…

Some of us don’t believe in fair-weather democracy. If they can run a poll, they can run an election. Ukrainians have the right to decide their own future, don’t you think? Or perhaps some are afraid that they might vote “wrong”?

A 30 second conversation with any Ukrainian living in Ukraine right now would clear this confusion up for you. Not getting people needlessly killed is awfully high up on the priority list. If you think Russia is above bombing polling places, you'd be wrong.

Re: Cyber Security: A pre-war reality check

#188

Post by 0cf8612b2e1e »

hughesjj wrote: post #137
plq wrote: post #128

Earlier quoted context omitted.

> The whole idea of the internet (and even some of our infra, like suburbs or highways/rail) is that there's no one single point of failure. Like designed-to-survive-nuclear-war redundant. Sure, the routing algorithms can quickly adapt to changes in network topology, but they assume infinite bandwidth, which hasn't been the case since a long time now. In other words, if a couple of important pipes disappear between t…

Definitely, we've seen this in fiber cuts before. That said a degraded availability is better than no availability. I know it's controversial in the context of net neutrality but personally I'd be okay with traffic shaping/prioritization for critical infra in cases such as this. Keep the power plants, emergency services, military, government, transit running over intsagram and netflix when things come down to it.

Does the government not maintain its own dedicated communication infrastructure between important installations? Or has it all been replaced with public connections?

Re: Cyber Security: A pre-war reality check

#189

Post by roenxi »

mopsi wrote: post #139
roenxi wrote: post #47

Earlier quoted context omitted.

Yeah, sure. But the US chooses who it integrates with militarily. An alternative approach would have been to say "hey, yeah we can see why you'd want to join - but this will foment tensions with Russia, so you can't". That is the kind of diplomacy would have prevented Russia from invading its neighbours. It would have been difficult to get worse outcomes with that approach than what the powers that be managed to get…

> That is the kind of diplomacy would have prevented Russia from invading its neighbours. Only if you subscribe to the argument that Russia has no intention to gobble up countries west of it at least to the furthest extent of USSR and its satellites. No European neighbors of Russia subscribe to that anymore. Finland and Sweden were the last holdouts who thought that having a "responsible" diplomacy would prevent war…

> Only if you subscribe to the argument that Russia has no intention to gobble up countries west of it at least to the furthest extent of USSR and its satellites.

Russia doesn't have any intention of doing that. Putin is currently 71 and we've seen no particular interest in grand campaigns to reconstitute the USSR so far in his lifetime, it isn't going to start. It turns out they weren't even militarily prepared to take Ukraine! They thought they could just launch a quick decapitation strike and be done. The USSR leadership disbanded the USSR in the 90s, so if they've culturally reversed position on that completely in 30 years it shows a stunning failure of western diplomacy to support them in doing the right thing.

> No European neighbors of Russia subscribe to that anymore.

Things like this is why letting them in to NATO would worry Russia. They are paranoid and panicking. I can understand why; I would be if I were a small country with a Russian border or close to one. But, nevertheless, their attitudes are one risk factor for escalating the situation from bad to catastrophic.

Re: Cyber Security: A pre-war reality check

#190

Post by wbl »

Dalewyn wrote: post #105
hughesjj wrote: post #103

Earlier quoted context omitted.

The back of my head is screaming "defense in depth! Redundant systems!" The whole idea of the internet (and even some of our infra, like suburbs or highways/rail) is that there's no one single point of failure. Like designed-to-survive-nuclear-war redundant. Definitely incorporate the most advanced tech you can for when things are going smoothly to get that efficency gain, but there's a reason all branches of the mil…

>The whole idea of the internet (and even some of our infra, like suburbs or highways/rail) is that there's no one single point of failure. Like designed-to-survive-nuclear-war redundant. The reality of course is that the internet has turned into a fragile, centralized system of complication that rests on single failure points like Cloudflare, AWS, and Chrome. The internet as envisioned by DARPA would have survived t…

Chrome works even if Google is down How is it an SPOF? And links mozilla.org will get you an alternative.
Post reply on HN