Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US companies hit by 'colossal' cyber-attack

bbc.com

Post reply on HN
Print view View original

211–220 of 514 posts

Re: US companies hit by 'colossal' cyber-attack

#211

Post by beermonster »

jiggawatts wrote: post #4

I never quite understood why these ransom-ware attackers restrict themselves to a small subset of the MSP's clients. E.g.: The SolarWinds attack affected only something like 1% of their customers, when it could easily have been 50% or more! If you're evil and out for money, wouldn't you want to cast the widest net possible? Similarly, by encrypting a huge number of corporations concurrently, you'd "exhaust" the abili…

> when it could easily have been 50% or more!

Was that down to slow patching cadence at 99% of companies?

In which case those customers have different vulnerabilities to tend to.

Re: US companies hit by 'colossal' cyber-attack

#212

Post by EugeneOZ »

C19is20 wrote: post #203
dehrmann wrote: post #169

Earlier quoted context omitted.

If we, the west, let Russia take Crimea and China take Hong Kong with minimal fuss, I don't see why a few cyber attacks would get more attention.

Take over? I thought Hong Kong was given back?

No, all the worst scenarios happened there.

Re: US companies hit by 'colossal' cyber-attack

#213

Post by TheOtherHobbes »

staticassertion wrote: post #160
awsthro00945 wrote: post #140

Earlier quoted context omitted.

>You clearly have no clue how it looks inside the board rooms and executive offices of some of these huge companies. This type of stuff is treated the exact same way as if a 400m building burns down. I sit with CISOs daily discussing this stuff. $400m expenditures is enough to scare the shit out of them. A $400m building burning down would have CEOs fired (see: Equifax CEO being fired after breach). I don't know what…

I agree with most of your points, but I think it's worth noting that "they didn't do as well as they could have" and "their CEO stepped down with a 90M severance" is a tough pill to swallow. Like, yes, Equifax could be doing better had they not been breached. I'm sure CISOs and board members are quite unhappy with a 400M dollar expenditure. But I also think it's very fair to say that that's getting off easy.

YoY it's a bad thing and makes for a bad year. But longer term the effect seems to have been negligible.

That could be because the $400m would likely have gone on dividends and remuneration, not investment.

Re: US companies hit by 'colossal' cyber-attack

#214

Post by kaba0 »

toe55 wrote: post #155
genmud wrote: post #68

After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if you can weather the storm, over the course of a year or two, there is effectively zero impact to your bottom line. You can also see this in the Solarwinds stock price. Year over year, they are down a hair under 4 percent... After being directly responsible for…

It's not bonkers. We have 20-30 years of data on cyber attacks and Cybersecurity is not that important - https://ubiquity.acm.org/article.cfm?id=3333611 Larger the dumps get the harder they are to exploit or do serious damage. I can hand you all my orgs data and 200 people who work with it everyday and it will still take you years to figure out what anything means.

Until it hits something important.. also, data breaches are just one form of cyber attacks.

Re: US companies hit by 'colossal' cyber-attack

#215

Post by kaba0 »

ipdd wrote: post #179
ChuckMcM wrote: post #109

Earlier quoted context omitted.

One could hope but I doubt it. CFO's gonna CFO and it's "cheaper" to outsource IT. I had one of these vendors really pushing me to "take a call" or "let them show me how they could cut costs". It was ALL about the costs. And I eventually called the CEO and said we would consider it if the company would take out a $100M bond that we could call on to repair any damage that occurred as a result of their managing our IT…

The CEO and CFO are right because this notion of reducing "attack surface" is not static. It changes from day to day and no technologist can guarantee what changes they add today makes any difference tomorrow. The promise is False. Therefore the principle of least action is justified.

“I will gotta leave open the windows and the door, and won’t even finish building the gates because I’m planning on extending the building and I will have to tore down a part either way”

Re: US companies hit by 'colossal' cyber-attack

#216

Post by EugeneOZ »

dehrmann wrote: post #169
eidelweissflow wrote: post #138

“ At a summit in Geneva last month, US President Joe Biden said he told Russian President Vladimir Putin he had a responsibility to rein in such cyber-attacks.” I don’t understand how Putin can stop these attacks unless he is personally responsible for them. Imagine someone in the US hacking systems in Russia or China. How in the hell Biden would know who did that and stop them? The naivety of US government is just a…

If we, the west, let Russia take Crimea and China take Hong Kong with minimal fuss, I don't see why a few cyber attacks would get more attention.

MH17 - 298 killed, 240 of them are from western countries. Not a single response. You are right, if western world doesn't care about their own people’s lives, they will barely care about the cyber attacks.

Re: US companies hit by 'colossal' cyber-attack

#217

Post by CyberRage »

genmud wrote: post #68

After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if you can weather the storm, over the course of a year or two, there is effectively zero impact to your bottom line. You can also see this in the Solarwinds stock price. Year over year, they are down a hair under 4 percent... After being directly responsible for…

Honestly, I'm shocked by this comment.

As if stock market is a perfect representation of a company performance, it is highly distorted\manipulated market.

SolarWind is fucked, they have a massive drop in new customers, I work with dozens of companies that are now plan to completely abandon their suites(those things take time).

Insurance is a trap. once you read the small letters, they don't fully cover the damage, usually only direct. Some have refused to pay due to some shady conditions that they insert into contracts to deceive customers(like any other insurance sector)

Re: US companies hit by 'colossal' cyber-attack

#218

Post by biztos »

genmud wrote: post #68

After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if you can weather the storm, over the course of a year or two, there is effectively zero impact to your bottom line. You can also see this in the Solarwinds stock price. Year over year, they are down a hair under 4 percent... After being directly responsible for…

> like fines and people going to jail for negligence

Being bad at your job is not negligence, nor is underestimating the threat.

It’d be nice to see consequences but I really don’t want to have the government locking people up for being well-paid fuck-ups.

Don’t some of these companies have… shareholders?

Re: US companies hit by 'colossal' cyber-attack

#219

Post by DoreenMichele »

colonelanguz wrote: post #19
yashap wrote: post #17

Earlier quoted context omitted.

Agreed. Companies that are great at selling to governments and massive enterprises tend to be great at security theatre and security certifications, but that’s not the same as being great at security. Their tech tends to be bloated spaghetti full of tech debt, with a huge surface area for attacks, and systems like that are nearly impossible to secure in a truly robust way. Embedding this kind of software deep in your…

Would you mind briefly explaining the concept of "tech debt" to a layperson?

It's a quick fix that will take more time to fix later than it would to do it properly now but typically gets done to meet a deadline because time is of the essence currently for some reason.

There is significant cognitive load in understanding the code and what it does and why it does it that way etc. Keeping all the important bits in one mind is challenging and a lot of the little fixes can lose sight of the big picture in a way that comes at a cost and, over time, this can really add up.

Over time, different people may work on the code and have different reasons why they made different choices and at some point it may all stop playing well together. Then there comes a point where someone needs to try to reconcile all the different bits and understand what needs to happen and why and rebuilding the entire catalog of goals, features, etc. in one mind at one time so someone actually understands it all and gets it right is a substantial future cost that only grows as you keep delaying that step.

(From one lay person to another -- I do write code, mostly html, and run some web projects, mostly blogs and Reddits, and spend too much time on HN. So technical debt isn't alien to my experience though I'm not really a programmer.)

Re: US companies hit by 'colossal' cyber-attack

#220

Post by CyberRage »

genmud wrote: post #95
awsthro00945 wrote: post #74

Earlier quoted context omitted.

This isn't really true. Stock price is not an indicator of a company's "bottom line". As someone who helps respond to major breaches at big companies, these types of breaches often result in enormous expenditures on company-wide efforts to close security gaps or revamp processes. Either a regulatory agency, or more often the company's board of directors, will make a mandate to the C-suite that something must be done.…

Dude, if you look at Equifaxes and Solarwinds EBITDA/earnings statements following their respective breaches, you will clearly see that there has been no major impact to their bottom line. Sure, expenses rise a bit for a short period of time, but these are not catastrophic by any means. I mean, I'm looking at Solarwinds last earnings statement and comparing quarters from last year to now, they are up about 3.5% in re…

That doesn't mean anything. in such a year their products should have flown off the shelves.

Remote monitoring\management? in COVID year? just 3.5%

that's horrendous

Post reply on HN