18 ms·

Corporate IT seems to disagree. Certainly they are sophisticated enough to know the risks, and they enable and use AMT widely. Personally, I hesitate more than

Corporate IT seems to disagree. Certainly they are sophisticated enough to know the risks, and they enable and use AMT widely. Personally, I hesitate more than most because of the technical reasons you cite, but even turning on a computer is a risk. Probably this isn't the greatest risk to a business' IT.

theossuary 9y ago
As somebody who consults with Corporate IT, more often then not I run into the mindset "well if every other company is taking on the same risk then it's a wash". Aka disabling SELinux is what everybody does, we aren't taking on any more risk than anybody else (and it'll make us more competitive because we can iterate faster), so why not? Very few companies think of security as a feature, because so few consumers think of security as a feature. I agree completely, many many companies are totally fine with accepting that risk due to the trade-off for ease of manageability. But I'm really not, in no small part because the overhead to managing a few computers is totally different than a large corporation with thousands of machines. I just wish my vote counted to Intel (or AMD for that matter), and I could completely disable ME because I'd rather the more difficult management of machines over the much larger attack surface. Of course it all seems to lead back to monopolies/duopolies being bad for the average consumer. Who knew?
- jacquesm 9y ago
  This is exactly right. Almost every company sees security simply as a cost.
- hackuser 9y ago
  I agree on all points; well-made. Thanks. > I just wish ... I could completely disable ME You might find this useful: https://puri.sm/learn/avoiding-intel-amt/ https://puri.sm/learn/avoiding-intel-amt/
  - theossuary 9y ago
    I stumbled upon puri.sm in an old reddit thread talking about this, I'm very intrigued by the systems they make. Also it seems disabling ME might be possible, though risky: https://hardenedlinux.github.io/firmware/2016/11/17/neutralize_ME_firmware_on_sandybridge_and_ivybridge.html https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...
benchaney 9y ago
This strikes me as an odd argument. Corporate America is notorious for not taking security seriously until it is too late. If you care at all about security you shouldn't take advice from what corporate IT is doing.

theossuary 9y ago

As somebody who consults with Corporate IT, more often then not I run into the mindset "well if every other company is taking on the same risk then it's a wash". Aka disabling SELinux is what everybody does, we aren't taking on any more risk than anybody else (and it'll make us more competitive because we can iterate faster), so why not? Very few companies think of security as a feature, because so few consumers think of security as a feature. I agree completely, many many companies are totally fine with accepting that risk due to the trade-off for ease of manageability. But I'm really not, in no small part because the overhead to managing a few computers is totally different than a large corporation with thousands of machines. I just wish my vote counted to Intel (or AMD for that matter), and I could completely disable ME because I'd rather the more difficult management of machines over the much larger attack surface. Of course it all seems to lead back to monopolies/duopolies being bad for the average consumer. Who knew?

jacquesm 9y ago
This is exactly right. Almost every company sees security simply as a cost.
hackuser 9y ago
I agree on all points; well-made. Thanks. > I just wish ... I could completely disable ME You might find this useful: https://puri.sm/learn/avoiding-intel-amt/ https://puri.sm/learn/avoiding-intel-amt/
- theossuary 9y ago
  I stumbled upon puri.sm in an old reddit thread talking about this, I'm very intrigued by the systems they make. Also it seems disabling ME might be possible, though risky: https://hardenedlinux.github.io/firmware/2016/11/17/neutralize_ME_firmware_on_sandybridge_and_ivybridge.html https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...

benchaney 9y ago

This strikes me as an odd argument. Corporate America is notorious for not taking security seriously until it is too late. If you care at all about security you shouldn't take advice from what corporate IT is doing.