Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

71–80 of 162 posts

Re: Heroku Security Notification

#71

Post by lovelearning »

Mandatum wrote: post #61
lovelearning wrote: post #49

> On April 7, 2022, a threat actor obtained access...GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation. Can some experienced security professionals weigh in on the cultural and organizational factors that allow this kind of major breach to go unnoticed for a week, that too in a reputed company like Heroku? I'm not asking this rhetoric…

Salesforce has been unable to attract or retain security talent. When they acquire a company, they close down the department that does security for that company - and then move everyone into the Salesforce Trust team. Unlike engineering who they typically leave alone (unless they're integrating or rebranding). In doing so, they typically lose everyone that setup the SIEM and run the SecOps center. Everything "securit…

Let's assume that prior to acquisition, Heroku sec had set up a very secure posture using such tech. Then they lost most of their experienced people after acquisition.

Some questions:

1) Are these tech not enough to enable others - perhaps less experienced, or experienced but not on a particular product - to take over while maintaining the same posture?

2) What kind of additional (perhaps intangible) security does an experienced team add to the posture that gets lost when they leave?

3) As I understand them, things like risk frameworks, NIST CSF, security assessments are all supposed to anticipate people problems (resignations, malicious insiders, etc) and make the posture as independent of them as possible, probably relying on automated tools like XDR and SOAR to do their thing regardless of who's sitting at the console. Does it not work like that in reality?

Btw, thank you for your reply and insights (and to everyone else who replies)! Pardon my probably naive questions. I'm an outsider looking in and having trouble understanding this phenomenon of data breaches in the face of all the tech marketing.

Re: Heroku Security Notification

#72

Post by Cthulhu_ »

photon12 wrote: post #62

There's going to be a question about the expected probability of this across cloud service providers. I've done security work for multiple cloud service providers and know a lot of people in the industry. I'm not really privy to give details. I can say: dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, secur…

I have no experience in organizations or IT systems that big, but, I can very much imagine that it's not only a matter of not having enough time to check everything, but over time, your systems become so big that it's hard to maintain an overview or, for that matter, control.

I mean, there's been numerous incidents of a random developer having copies of customer data on their systems, or accidentally opening up a database or an Elasticsearch instance to the world.

And I'm afraid the only way to help mitigate that is to restrict what an individual can access and do on the one hand, and bureaucracy on the other. And full-time staff whose only job is to maintain security and juggle access rights around.

Re: Heroku Security Notification

#74

Post by everfrustrated »

lovelearning wrote: post #49

> On April 7, 2022, a threat actor obtained access...GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation. Can some experienced security professionals weigh in on the cultural and organizational factors that allow this kind of major breach to go unnoticed for a week, that too in a reputed company like Heroku? I'm not asking this rhetoric…

Most security products are snake oil. The vendor selling them and the people buying them (always business execs never engineers) have no interest in how well it actually works as a company is never buying these tools to actually be secure only ever to give the impression to some higher exec within the same company or tick a box on some audit process (which requires something to be in place but doesn't require verifying it works).

It's beyond a joke how the "cyber" industry operates.

Re: Heroku Security Notification

#75

Post by henryaj »

Obviously Heroku have handled this horribly - but are any small startups out there considering replatforming? Still seems like a lot of hassle and the competition I've tried (Cloud66, excid3's thing) haven't been as good.

Re: Heroku Security Notification

#76

Post by ryanSrich »

samwillis wrote: post #68

Well, it only seems to be getting worse on this one. I’m keen to get off Heroku, but waiting for one of the newer alternatives (Render/Fly+others) to implement WAL point in time restore for Postgres. It’s the only thing keeping me on Heroku now, but is indispensable. Anyone here from them have any update on when we could see that feature made available?

I’m also interested in this. I have 4 decent sized applications I want to migrate, but I don’t have the resources to self host on GCP or AWS. K8s is nice in theory, but I know from experience it requires too much hand holding (let alone other managed services like a database and cache).

From what I’ve seen in the market, fly, render, and railway are the only real Heroku competitors. All seem to be missing a few critical pieces of functionality that is preventing me from migrating. Railway doesn’t appear to allow me to remotely run Python commands, they also don’t have automated nightly backups. Fly and Render respectively have a handful of missing features. It would be amazing if one of these services came out with 1:1 feature parity with Heroku. I’d move in a heartbeat.

Re: Heroku Security Notification

#78

Post by beninsydney »

productceo wrote: post #5

What are some good Heroku alternatives these days?

Digital Ocean's "App Platform" is pretty nice, although not as slick as Heroku -

https://www.digitalocean.com/products/app-platform

Railway.app is pretty nice, very slick interface, this has the most "heroku-feel" -

https://railway.app

Re: Heroku Security Notification

#79

Post by hnbad »

pm90 wrote: post #69
photon12 wrote: post #62

There's going to be a question about the expected probability of this across cloud service providers. I've done security work for multiple cloud service providers and know a lot of people in the industry. I'm not really privy to give details. I can say: dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, secur…

Agreed. cloud providers’ incentives are aligned with growth which naturally mean easy accessibility; hence all the defaults being generally “open”. Its so easy to make a resource accessible to anyone, or an IP accessible from anywhere in the cloud without proper restrictions by internal teams in the company; and often the default is to give teams superadmin to “unblock their time sensitive project” rather than mainta…

> cloud providers’ incentives are aligned with growth which naturally mean easy accessibility; hence all the defaults being generally “open”

So no different from every VC funded startup (or startup seeking VC funding) then?

The sentiment of imposing tighter regulations around data security feels counter to the general idea that the lack of regulations around data security (e.g. strong data protection laws) are what allows the US tech industry to dominate compared to its EU equivalents.

I'm not disagreeing with this, I'm just pointing out the contradiction and wondering how those who believe the latter would reconcile that belief with demanding the former.

Re: Heroku Security Notification

#80

Post by gizzlon »

ryanSrich wrote: post #76
samwillis wrote: post #68

Well, it only seems to be getting worse on this one. I’m keen to get off Heroku, but waiting for one of the newer alternatives (Render/Fly+others) to implement WAL point in time restore for Postgres. It’s the only thing keeping me on Heroku now, but is indispensable. Anyone here from them have any update on when we could see that feature made available?

I’m also interested in this. I have 4 decent sized applications I want to migrate, but I don’t have the resources to self host on GCP or AWS. K8s is nice in theory, but I know from experience it requires too much hand holding (let alone other managed services like a database and cache). From what I’ve seen in the market, fly, render, and railway are the only real Heroku competitors. All seem to be missing a few criti…

Google Cloud Run or App Engine Standard might be what you want:

https://cloud.google.com/run/docs/quickstarts

https://cloud.google.com/appengine/docs/standard

Unfortunately some things are more difficult than necessary =/ OTOH the GCP ecosystem, network, and data-center presence are vast.

Post reply on HN