7 ms·

Good. Also, don't hire good devs, only hire the cheap ones in India. Money saved can be paid to these providers. That way, the money stays in the us. A 10k IQ

Good. Also, don't hire good devs, only hire the cheap ones in India. Money saved can be paid to these providers. That way, the money stays in the us. A 10k IQ move that no one will understand. /s ov course

qaq 2y ago
It's to a degree orthogonal to devs your hire as well resourced APT will be able to penetrate any org regardless of quality of developers an org hires.
- peteradio 2y ago
  Inevitably the cause of the breach will be something like an open firewall.
  - bluGill 2y ago
    70% of security vulnerabilities in code are memory safety issues. However the vast majority of in then wild attacks were not against security vulnerabilities but against people. No technology can protect you from someone giving out the secret keys to the attacker.
    - waihtis 2y ago
      just false, if you look at most of the ransomware cases for example. This whole fixation of "human layer security" has done more harm to cybersecurity than many actually malicious things. Wasting your money and resources on training Karen from HR to spot 20% more phishing emails yields exactly the results you'd think it does. I hope we can get out of that nonsense and tackle cyber issues with actual technological investments as it should and can be done.
      - loeg 2y ago
        The technology solution here is not allowing Karen from HR to have a password at all and instead using something like Yubikey + FIDO, which can't be phished.
        bluGill 2y ago
        Which is great until someone who might or might not really be "Karen from HR" says they lost their Yubikey and needs a new one. This workflow must exist, but it is generally easy for an attacker to get authenticated by that system.
        loeg 2y ago
        That is a significantly higher barrier than phishing.
        bluGill 2y ago
        often The point of fishing is to get enough info to fool that sywtem.
      - bluGill 2y ago
        The only part of what you said that disagrees with me is the words "just false". I don't know how to ensure "Karen from HR" doesn't fall for those things, but training is clearly not enough (or at least current training, I'm not hopeful for future efforts but...). Either way, since the attack wasn't against something a programing language can protect against no amount of fixing programming languages will help. We need come up with answers that work despite humans not being perfect. This is a hard problem. (what gets hard is sometimes someone will lose/forget a key and so you need to issue a replacement but only to the correct person)
        deleted 2y ago
        [deleted]
        waihtis 2y ago
        i wrote a different reply initially but i think we agree after all, and i misinterpreted your original post.
- ixaxaar 2y ago
  Any org? Would, for example, openai be included in your definition of "any org"? Look, "in principle" stuff is not how the real world works. AFAIK, hacks happen mostly because of carelessness. No one cares because no one cares if they care (and the compensations etc reflect that). I know enough such cases in fintech (forget about other verticals), which are mostly stupid like wrong RBAC, open firewall, AWS keys taken by roommate etc and not public of course.
  - nradov 2y ago
    Foreign governments are almost certainly trying to insert intelligence agents as employees in OpenAI, and other high profile technology companies. We already know that Saudi intelligence infiltrated Twitter. There are likely many other such agents in other companies. https://www.nbcnews.com/tech/security/former-twitter-employee-sentenced-three-years-prison-spying-saudi-arab-rcna61384 https://www.nbcnews.com/tech/security/former-twitter-employe... There are certain security measures which can minimize insider threats. But ultimately it's just hard to guard against agents who are willing to commit felonies in order to carry out their missions. Even defense industry companies which have tight security over classified information have been repeatedly penetrated.
    - cduzz 2y ago
      The Saudis gave a pile of cash to Musk so they likely have their own Room 641A now. No need for subterfuge.
  - Veserv 2y ago
    Yes. Any org. A few million dollars guarantees you unrestricted access to any network-connected system. The upper bound of security is unable to make attacks with a 10 M$ return unprofitable. Raising the lower bar just raises the barrier to entry for new participants, it does not stop existing ones. Most attacks do use basic techniques since a 10 M$ payout on 10 K$ cost is still better than 10 M$ payout on 1 M$ cost. No point wasting the good stuff when the basic and cheap stuff works just as well. But if you get rid of all the cheap ways in they will still attack using the more expensive stuff since the payout is still wildly profitable.
nradov 2y ago
There's no evidence that this attack was due to poor UHG developer quality. It appears to have been an infrastructure security vulnerability in the Change Healthcare business unit, which UHG acquired just last year.
- peteradio 2y ago
  > It appears to have been an infrastructure security vulnerability in the Change Healthcare business unit UHG developers would be responsible for the infrastructure right? And wouldn't Change have been brought under the UHG network?
  - infamouscow 2y ago
    I worked in healthcare tech for 10 years. I would bet my life savings UHG developers pleaded with management for years to get the resources they desperately need to resolve these problems, but management ignored every request because it didn't have any external impact. Management in healthcare tech is comprised entirely by some of the most mind boggling idiots on Earth, whose only qualification might be being an adult, since their ability to read, write, and comprehend information is universally worse than a child. This is without exception, in my experience.
    - willcipriano 2y ago
      Step one: ask for resources until you stop getting them Step two: avoid all accountability for anything that ever happens as the resources offered to you are finite
      - infamouscow 2y ago
        Putting the braindead straw man aside: The systems built were designed for a business that evolved, and the assumptions and constraints changed in a way that sometimes requires redoing things. This can be as simple as an assumption about how sales will be acquiring new clients, and how those new clients affect overall system scalability. If there's a long pipeline of feature requests and sales supersedes product managers on roadmaps, doing the necessary work to scale the systems is going to be deprioritized to a point where anything other than downtime is acceptable from a business standpoint. Sales are made on features being built, not on an impending doom that has yet to happen. This extends to other aspects of systems, like security.
adventurer 2y ago
Pretty sure they aim to outsource 70% going forward so this isn’t as clever a joke as you would hope.

qaq 2y ago

It's to a degree orthogonal to devs your hire as well resourced APT will be able to penetrate any org regardless of quality of developers an org hires.

peteradio 2y ago
Inevitably the cause of the breach will be something like an open firewall.
- bluGill 2y ago
  70% of security vulnerabilities in code are memory safety issues. However the vast majority of in then wild attacks were not against security vulnerabilities but against people. No technology can protect you from someone giving out the secret keys to the attacker.
  - waihtis 2y ago
    just false, if you look at most of the ransomware cases for example. This whole fixation of "human layer security" has done more harm to cybersecurity than many actually malicious things. Wasting your money and resources on training Karen from HR to spot 20% more phishing emails yields exactly the results you'd think it does. I hope we can get out of that nonsense and tackle cyber issues with actual technological investments as it should and can be done.
    - loeg 2y ago
      The technology solution here is not allowing Karen from HR to have a password at all and instead using something like Yubikey + FIDO, which can't be phished.
      - bluGill 2y ago
        Which is great until someone who might or might not really be "Karen from HR" says they lost their Yubikey and needs a new one. This workflow must exist, but it is generally easy for an attacker to get authenticated by that system.
        loeg 2y ago
        That is a significantly higher barrier than phishing.
        bluGill 2y ago
        often The point of fishing is to get enough info to fool that sywtem.
    - bluGill 2y ago
      The only part of what you said that disagrees with me is the words "just false". I don't know how to ensure "Karen from HR" doesn't fall for those things, but training is clearly not enough (or at least current training, I'm not hopeful for future efforts but...). Either way, since the attack wasn't against something a programing language can protect against no amount of fixing programming languages will help. We need come up with answers that work despite humans not being perfect. This is a hard problem. (what gets hard is sometimes someone will lose/forget a key and so you need to issue a replacement but only to the correct person)
      - deleted 2y ago
        [deleted]
      - waihtis 2y ago
        i wrote a different reply initially but i think we agree after all, and i misinterpreted your original post.
ixaxaar 2y ago
Any org? Would, for example, openai be included in your definition of "any org"? Look, "in principle" stuff is not how the real world works. AFAIK, hacks happen mostly because of carelessness. No one cares because no one cares if they care (and the compensations etc reflect that). I know enough such cases in fintech (forget about other verticals), which are mostly stupid like wrong RBAC, open firewall, AWS keys taken by roommate etc and not public of course.
- nradov 2y ago
  Foreign governments are almost certainly trying to insert intelligence agents as employees in OpenAI, and other high profile technology companies. We already know that Saudi intelligence infiltrated Twitter. There are likely many other such agents in other companies. https://www.nbcnews.com/tech/security/former-twitter-employee-sentenced-three-years-prison-spying-saudi-arab-rcna61384 https://www.nbcnews.com/tech/security/former-twitter-employe... There are certain security measures which can minimize insider threats. But ultimately it's just hard to guard against agents who are willing to commit felonies in order to carry out their missions. Even defense industry companies which have tight security over classified information have been repeatedly penetrated.
  - cduzz 2y ago
    The Saudis gave a pile of cash to Musk so they likely have their own Room 641A now. No need for subterfuge.
- Veserv 2y ago
  Yes. Any org. A few million dollars guarantees you unrestricted access to any network-connected system. The upper bound of security is unable to make attacks with a 10 M$ return unprofitable. Raising the lower bar just raises the barrier to entry for new participants, it does not stop existing ones. Most attacks do use basic techniques since a 10 M$ payout on 10 K$ cost is still better than 10 M$ payout on 1 M$ cost. No point wasting the good stuff when the basic and cheap stuff works just as well. But if you get rid of all the cheap ways in they will still attack using the more expensive stuff since the payout is still wildly profitable.

nradov 2y ago

There's no evidence that this attack was due to poor UHG developer quality. It appears to have been an infrastructure security vulnerability in the Change Healthcare business unit, which UHG acquired just last year.

peteradio 2y ago
> It appears to have been an infrastructure security vulnerability in the Change Healthcare business unit UHG developers would be responsible for the infrastructure right? And wouldn't Change have been brought under the UHG network?
- infamouscow 2y ago
  I worked in healthcare tech for 10 years. I would bet my life savings UHG developers pleaded with management for years to get the resources they desperately need to resolve these problems, but management ignored every request because it didn't have any external impact. Management in healthcare tech is comprised entirely by some of the most mind boggling idiots on Earth, whose only qualification might be being an adult, since their ability to read, write, and comprehend information is universally worse than a child. This is without exception, in my experience.
  - willcipriano 2y ago
    Step one: ask for resources until you stop getting them Step two: avoid all accountability for anything that ever happens as the resources offered to you are finite
    - infamouscow 2y ago
      Putting the braindead straw man aside: The systems built were designed for a business that evolved, and the assumptions and constraints changed in a way that sometimes requires redoing things. This can be as simple as an assumption about how sales will be acquiring new clients, and how those new clients affect overall system scalability. If there's a long pipeline of feature requests and sales supersedes product managers on roadmaps, doing the necessary work to scale the systems is going to be deprioritized to a point where anything other than downtime is acceptable from a business standpoint. Sales are made on features being built, not on an impending doom that has yet to happen. This extends to other aspects of systems, like security.

adventurer 2y ago

Pretty sure they aim to outsource 70% going forward so this isn’t as clever a joke as you would hope.