6 ms·

This is ridiculous and really only happens because the cost of securing your customer (or citizen) data is higher than the cost of losing control of it. If the

This is ridiculous and really only happens because the cost of securing your customer (or citizen) data is higher than the cost of losing control of it. If the cost of losing data to hacks was, say three times higher than the cost estimated to secure it, the problem would become much less common very quickly. As it is, states and corporations externalize the costs of hacks to the victims of their incompetence. They have no reason to take opsec seriously because they aren't held liable in even the most egrigious cases. Data should be a liability.

wmf 3y ago
For government IT in particular, the cost of security is basically infinite because they aren't organizationally mature enough to do anything right. There's no way to make the cost of being hacked infinite; no court or legislature is going to order the DMV to be disbanded.
- AnthonyMouse 3y ago
  In 1995 the California State Police were disbanded and their role was given to the California Highway Patrol. The part of the DMV that performs driver testing isn't the part that loses all your data. It wouldn't be impossible to disband their IT department and give the role to some other government agency. They could also just, you know, stop collecting it. Print your height and hair color etc. on your driver's license and don't store it anywhere else. Instead store a hash of it at the DMV with the salt stored on the license itself, so you can revalidate the license without being able to reconstitute it.
- dragonwriter 3y ago
  > There's no way to make the cost of being hacked infinite; no court or legislature is going to order the DMV to be disbanded Disbanding the DMV doesn’t make the cost to any actor infinite (“DMV” is an abstraction, and state agencies are routinely created amd destroyed, sometimes as political damage control due to IT scandals [0], but that’s not an infinite cost on anyone.) [0] e.g., the California Department of Information Technology in 2002: https://www.google.com/amp/s/www.computerworld.com/article/2577563/amid-controversy--california-state-it-agency-goes-under.amp.html https://www.google.com/amp/s/www.computerworld.com/article/2...
_8j50 3y ago
You have a lot of opinion here but this was a zero day attack. Would love to hear your opinion on how Louisiana could have safeguarded against that.
- fsflover 3y ago
  On Qubes OS even a zero-day would likely not be sufficient. It relies on hardware virtualization and runs everything in VMs. My daily driver, can't recommend it enough.
  - _8j50 3y ago
    You should pay attention to pwn2own every year where it is common for competitors to find a browser rce and VM escape exploit.
    - fsflover 3y ago
      Last time a VT-d VM escape was discovered in 2006, and it was done by the Qubes founder: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).
      - _8j50 3y ago
        It doesn't have to be vt-d: https://keenlab.tencent.com/en/2018/04/23/A-bunch-of-Red-Pills-VMware-Escapes/ https://keenlab.tencent.com/en/2018/04/23/A-bunch-of-Red-Pil... I can confidently tell you that your understanding of security mitigations is flawed. And I say that based on experience not just a baseless opinion. Silver bullets in security don't exist. Let's every moveit instance was run in a container in a vm and in a dmz (actually moveit transfer is usually deployed in a dmz, isolated from everything else). But the entire purpose of the software is to contain all these important files and expose them to authorized parties, basically a file server (even has sftp!). The threat actors in this case didn't even bother compromising the OS, they just got a session id as a result of abusing sqli and .net deserialization flaw and logged into the webui and downloaded the files. At no point could a vm have stopped any of this. I said your undersranding is flawed because you mindset is solution centric not data centric. If all an attacker cares about is access to your gmail, a qubes VM with strict selinux rules is useless if they get you to click on a link that exploits firefox to steal your gmail cookies, defeating any yubikey 2fa you may have.
nyc_data_geek1 3y ago
>> Data should be a liability. This is the crux of it, methinks. "Data is the new oil" has been a common refrain and as long as the externalities of poor security posture hygiene can be completely outsourced while these companies make mountains of cash by monetizing your every scrap of behavior, attention and information, this will only get worse as every entity seeks to hoard more information on you. Keeping more data than absolutely necessary for critical business operations should be an existential threat for any entity. Those businesses built on this data ought to take Fort Knox level pains to secure it. Anything short of that and we will continue to exist in a society of deteriorating trust and social contract.
- ronsor 3y ago
  > "Data is the new oil" The common usage of this phrase isn't too inaccurate. Keep in mind what oil does to the environment, not just during spills but even in normal refining!
  - PakG1 3y ago
    When oil is refined, it feeds energy consumption, which can have both positive and negative effects. When data is refined, it feeds AI, which can have both positive and negative effects. When oil spills, it causes toxic damage to the environment. When data spills, it causes damage to society's individuals and the firms that should have kept the data secure. It's not a perfect analogy, but there are some similarities.
- cco 3y ago
  A framing I often use is, "Data is like holding uranium". It can be incredibly valuable, but also very dangerous. You should be very sure that the data you're holding is worth the cost of safely protecting it (a high cost), and if it is not, get rid of it. Stripe is a good mental model here, I don't want a person's credit card data, I want to charge them for my product. I love storing a Stripe customer ID, if a hacker were to grab that table, I wouldn't lose (a lot) of sleep, they couldn't do much with it. If that table held credit card data...I would. That farms out a lot of responsibility to Stripe, but for a side project, I don't have the time necessary to do as good of a job at it relative to Stripe.
jfengel 3y ago
The cost benefit calculation also includes the odds of being hacked. Enormous numbers of organizations are at risk but most survive by security by obscurity. Most are content to hope to remain obscure. Especially since the cost of actual security is very high. You have to build it into every aspect of the system. It makes development cost an order of magnitude more and constrains usability... and you'll still never really be certain When you take employees into account the cost becomes almost insurmountable. Keeping bank style security means tightly limiting access, making even simple operations more work. That's not an excuse. That's a warning. We are at grave risk, and we need to completely reconsider how almost every piece of software is written. Competence is hard and expensive.
vlan0 3y ago
State government is tricky. Pay sucks and doesn’t attract a lot of talent. Same with the education sector.
- wmf 3y ago
  Government IT is outsourced at prices that could pay top salaries (think Palantir). They just don't.
  - dragonwriter 3y ago
    > Government IT is outsourced at prices that could pay top salaries Mostly, its not; a lot is not outsourced, and a lot that is is outsourced on personal services contracts at rates that even if there was no vendor overhead wouldn’t pay for a top-flight pay and benefits package.
l33t233372 3y ago
> If the cost of losing data to hacks was, say three times higher than the cost estimated to secure it I’d estimate that if this happened, the cost to secure data would grow by about a factor of 3.
AndrewKemendo 3y ago
>Data should be a liability. Exactly. Mandate financial compensation for any and all value derived from data that an individual creates, whether they opted in or not. If YC ran banner ads and my comment is viewed on the same page as an ad, then I should receive some significant percentage of that ad revenue. If an ad is targeted to a customer on IG through an ad campaign, based on the user's data, then the user should get a significant percentage of that ad. That should clear everything up.

wmf 3y ago

For government IT in particular, the cost of security is basically infinite because they aren't organizationally mature enough to do anything right. There's no way to make the cost of being hacked infinite; no court or legislature is going to order the DMV to be disbanded.

AnthonyMouse 3y ago
In 1995 the California State Police were disbanded and their role was given to the California Highway Patrol. The part of the DMV that performs driver testing isn't the part that loses all your data. It wouldn't be impossible to disband their IT department and give the role to some other government agency. They could also just, you know, stop collecting it. Print your height and hair color etc. on your driver's license and don't store it anywhere else. Instead store a hash of it at the DMV with the salt stored on the license itself, so you can revalidate the license without being able to reconstitute it.
dragonwriter 3y ago
> There's no way to make the cost of being hacked infinite; no court or legislature is going to order the DMV to be disbanded Disbanding the DMV doesn’t make the cost to any actor infinite (“DMV” is an abstraction, and state agencies are routinely created amd destroyed, sometimes as political damage control due to IT scandals [0], but that’s not an infinite cost on anyone.) [0] e.g., the California Department of Information Technology in 2002: https://www.google.com/amp/s/www.computerworld.com/article/2577563/amid-controversy--california-state-it-agency-goes-under.amp.html https://www.google.com/amp/s/www.computerworld.com/article/2...

_8j50 3y ago

You have a lot of opinion here but this was a zero day attack. Would love to hear your opinion on how Louisiana could have safeguarded against that.

fsflover 3y ago
On Qubes OS even a zero-day would likely not be sufficient. It relies on hardware virtualization and runs everything in VMs. My daily driver, can't recommend it enough.
- _8j50 3y ago
  You should pay attention to pwn2own every year where it is common for competitors to find a browser rce and VM escape exploit.
  - fsflover 3y ago
    Last time a VT-d VM escape was discovered in 2006, and it was done by the Qubes founder: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).
    - _8j50 3y ago
      It doesn't have to be vt-d: https://keenlab.tencent.com/en/2018/04/23/A-bunch-of-Red-Pills-VMware-Escapes/ https://keenlab.tencent.com/en/2018/04/23/A-bunch-of-Red-Pil... I can confidently tell you that your understanding of security mitigations is flawed. And I say that based on experience not just a baseless opinion. Silver bullets in security don't exist. Let's every moveit instance was run in a container in a vm and in a dmz (actually moveit transfer is usually deployed in a dmz, isolated from everything else). But the entire purpose of the software is to contain all these important files and expose them to authorized parties, basically a file server (even has sftp!). The threat actors in this case didn't even bother compromising the OS, they just got a session id as a result of abusing sqli and .net deserialization flaw and logged into the webui and downloaded the files. At no point could a vm have stopped any of this. I said your undersranding is flawed because you mindset is solution centric not data centric. If all an attacker cares about is access to your gmail, a qubes VM with strict selinux rules is useless if they get you to click on a link that exploits firefox to steal your gmail cookies, defeating any yubikey 2fa you may have.

nyc_data_geek1 3y ago

>> Data should be a liability. This is the crux of it, methinks. "Data is the new oil" has been a common refrain and as long as the externalities of poor security posture hygiene can be completely outsourced while these companies make mountains of cash by monetizing your every scrap of behavior, attention and information, this will only get worse as every entity seeks to hoard more information on you. Keeping more data than absolutely necessary for critical business operations should be an existential threat for any entity. Those businesses built on this data ought to take Fort Knox level pains to secure it. Anything short of that and we will continue to exist in a society of deteriorating trust and social contract.

ronsor 3y ago
> "Data is the new oil" The common usage of this phrase isn't too inaccurate. Keep in mind what oil does to the environment, not just during spills but even in normal refining!
- PakG1 3y ago
  When oil is refined, it feeds energy consumption, which can have both positive and negative effects. When data is refined, it feeds AI, which can have both positive and negative effects. When oil spills, it causes toxic damage to the environment. When data spills, it causes damage to society's individuals and the firms that should have kept the data secure. It's not a perfect analogy, but there are some similarities.
cco 3y ago
A framing I often use is, "Data is like holding uranium". It can be incredibly valuable, but also very dangerous. You should be very sure that the data you're holding is worth the cost of safely protecting it (a high cost), and if it is not, get rid of it. Stripe is a good mental model here, I don't want a person's credit card data, I want to charge them for my product. I love storing a Stripe customer ID, if a hacker were to grab that table, I wouldn't lose (a lot) of sleep, they couldn't do much with it. If that table held credit card data...I would. That farms out a lot of responsibility to Stripe, but for a side project, I don't have the time necessary to do as good of a job at it relative to Stripe.

jfengel 3y ago

The cost benefit calculation also includes the odds of being hacked. Enormous numbers of organizations are at risk but most survive by security by obscurity. Most are content to hope to remain obscure. Especially since the cost of actual security is very high. You have to build it into every aspect of the system. It makes development cost an order of magnitude more and constrains usability... and you'll still never really be certain When you take employees into account the cost becomes almost insurmountable. Keeping bank style security means tightly limiting access, making even simple operations more work. That's not an excuse. That's a warning. We are at grave risk, and we need to completely reconsider how almost every piece of software is written. Competence is hard and expensive.

vlan0 3y ago

State government is tricky. Pay sucks and doesn’t attract a lot of talent. Same with the education sector.

wmf 3y ago
Government IT is outsourced at prices that could pay top salaries (think Palantir). They just don't.
- dragonwriter 3y ago
  > Government IT is outsourced at prices that could pay top salaries Mostly, its not; a lot is not outsourced, and a lot that is is outsourced on personal services contracts at rates that even if there was no vendor overhead wouldn’t pay for a top-flight pay and benefits package.

l33t233372 3y ago

> If the cost of losing data to hacks was, say three times higher than the cost estimated to secure it I’d estimate that if this happened, the cost to secure data would grow by about a factor of 3.

AndrewKemendo 3y ago

>Data should be a liability. Exactly. Mandate financial compensation for any and all value derived from data that an individual creates, whether they opted in or not. If YC ran banner ads and my comment is viewed on the same page as an ad, then I should receive some significant percentage of that ad revenue. If an ad is targeted to a customer on IG through an ad campaign, based on the user's data, then the user should get a significant percentage of that ad. That should clear everything up.