92 replies
18h8m
I feel like this goes too deep. Or maybe it hits on the right reason, but the wrong cause. The defender’s job isn’t defense. Cyber security isn’t a sportsball game where there are clear even goals and objectives with alternating positions. It’s a side show, and a distraction from the main business of whatever else the defenders are trying to do. By contrast, an attacker’s entire job is to attack the system. There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks.
Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end
I think the main problem is that most organizations put security at the end of the budget list.
Even if they put it near the top, it's still going to be reduced in effectiveness by the actual needs and goals of the organization. Any company that has a VPN and remote employees is objectively and inherently weaker from a cyber security standpoint than an otherwise equally equipped company with no external access to the network. But they do that because remote employee access means they can do their actual business better. Any company that uses networked computers in objectively and inherently weaker from a cyber security standpoint than one which requires physically moving data from one machine to another by way of personal handoffs between employees at the same physical location, but they do that because it means they can do their actual business better.
It does not matter if cyber security is at the top or the bottom of your budget list, if the choice is ever "better cyber security" or "do more business", cyber security is always going to lose that battle. You will never convince a company to use E2E encrypted email for all communications with all customers and vendors, no matter how high on the budget list cyber security is, because doing so would actively hinder the day to day operations of the business.
I don't think this is relevant. Even on-prem "air gapped" networks get breached. I would say it happens on as frequent a basis as any other network tbh. Microsoft hacks get headlines because Microsoft is a public company; there are lots of undisclosed breaches happening out there.
Security vulnerabilities come from the same place they always have. Where IO happens, where transactions happen, and where an operating system does a lot of work. How attackers get to these points, what happens when they do, and then how the system reacts when a malicious event occurs are the factors that matter.
In today's world of complex technologies, I have yet to meet a single organization that is invulnerable to these threats. I've seen a lot of organizations limit damage, patch vulnerabilities, and generally manage their risk profile effectively - but losses are a part of the business.
IMO, the only thing that will really make a difference is when we have technologies that are sufficient enough to male the user more resilient. Only then can we have a truly safer web.
I’m sorry but I really really really want some citations here - a network that has VPNs, LANs at multiple locations is as vulnerable as a single location that uses air-gapped computers passing say usb sticks around to share say git repos.
I am not sure I would enjoy working at the second place but I would really hope we weren’t an easy target
It's been shown many times that people will pick up random USB devices from anywhere and plug them into any computer without thinking. Airgapping just stops the automated scans and stuff that was already being stopped. Defence is reactive, so the momentum and advantage is always on the attacker side, and stopping the lazy ones doesn't do anything to stop the real threats.
People die in car crashes although they have seat belts, it's been shown many times, so seat belts doesn't do anything to stop the real danger.
The costs of seatbelts are already built in to the car. The cost of airgapping is not. The sheer inconvenience and limiting of the potential employee pool would put it far out of budget for anyone but governments or very large corporations doing very sensitive work, and even in those cases it would be on a site-by-site basis, not org-wide.
Viruses that infect USB devices can compromise systems based on air gaps.
Cf. eg., https://www.schneier.com/blog/archives/2013/10/air_gaps.html and https://www.schneier.com/blog/archives/2020/05/ramsey_malwar...
...really?
I find this extremely hard to believe on its face. Sure an attacker can infect a system via a USB drive, but they need to get physically close to the victim (at least at one point in time). That both dramatically decreases the number of possible attackers and increases their personal risk.
It also becomes far more difficult for an attacker to exfiltrate any data.
Exfil may be tricky if the system is actually airgapped - I take GP's use of scare quotes to mean that most systems are "airgapped" by means of software-enforced security policies, which should correctly be referred to as "not airgapped".
As for the attack method, there's always the good ol' "flash drive found on a parking lot" vector.
Right, which requires the attacker to be physically near the parking lot at some point! That decreases the number of possible attackers by several orders of magnitude at least.
Ah, that makes more sense! I do think tpmoney was quite clearly talking about truly airgapped systems, however.
Very much so. My point being that a truly air gapped system is objectively more secure than one that is networked, and yet, a bank or social network company that only operates with truly air gapped systems will be strictly worse off than their competitors in their actual business of banking or social networking. And so since their actual job is not objectively better cyber security, but banking or social networking, then they are inherently at a disadvantage compared to Attackers whose business IS attacking (or at one step removed, selling the resources obtained from attacking). In the name of making their business better, Defenders will chose weaker security, and attackers will chose stronger attacks.
Yeah, GP is sort of saying that seat belts are pointless since traffic fatalities can happen anyway
My point is that the vulnerable points, regardless of where they come from, are ultimately there because the purpose of the Defender is not to have perfect cyber security, but to use computers and technology to enable business. Or as you said, "losses are a part of the business"; and that's so because "the business" isn't cyber security.
Citation extremely needed.
I have worked at 20+ companies and the ones that had little to no security got ransomwared at LEAST yearly (with 50m+ in revenues) and the ones that had basic and standard security practices got zero network wide intrusions (at least at lower then say, a nation state level.)
Now, COULD they have been exploited with an 0day? Sure, in theory these networks could be both exploited with the same technology or by a dedicated actor likely without an issue - they're internet connected corporate networks mostly with probably out of date tech; and in practice most attacks corporations need to mitigate are the drive by trash that consumers also face.
If this is true, big if, it’s because air gapping doesn’t happen without a specific threat model in mind. Think of the airplane with red dots.
the safest computer is turned off, in a Faraday cage, in a vault under a mountain.
Or thrown out from the solar system, antenna facing an other galaxy
The parent wrote that "most organizations put security at the end of the budget list", but he did not write that it should be put at the top of the budget list. Your criticism would only be valid if he had written the latter.
The parent wrote that the "main problem" was that they put the security at the end of the budget list. My argument is it doesn't matter where it is on the budget list, it will always be subservient to the actual business of the Defender. That is, my argument is the "main problem" is that perfect cyber security Defense isn't anyone's actual business.
Where would you put it. Before feature development, headcount, infrastructure, marketing, sales, management, hr, facilities?
Compartmentalizing it is an issue in itself.
Replace "security" with "safety" for, IDK, space engineering or nuclear power. Does it still make sense?
Safety and security need to be integral parts of processes. It is not something you can acquire from a vendor or split out as the responsibility of separate team(s) who have to internally battle for resources and interface with the core development through escalation requests...
Here's a question: Why do most safety regulations require the force of law to get companies to enact, but no laws were necessary to get companies to adopt the internet? "Safety" is in a similar boat to security, with the benefit that you usually don't have people actively trying to harm your employees. But Safety often gets tossed out the window when it gets in the way of accomplishing the real goals of the organization. Why is the US military exempt from a number of safety regulations that private companies are beholden to? Because the military believes those regulations will hamper their real mission, which is not keeping individual soldiers safe.
Indeed. Also, it's even tougher to argue to stop increasing safety at some point, because it usually means arguing for accepting a certain number of lives or limbs lost. And yet we do, and we have to, because like with security, a perfectly safe system is one that does nothing at all.
But safety isn't security, and your random SaaS pets.com clone isn't a space shuttle. Safety is more about reliability. Security in space systems is very much bolt-on and split out: the concern of everyone working on a rocket is that it flies and lands safely. Who is or isn't authorized to launch it is a worry of another department.
Security is PvP, safety is PvE. Different game, different tactics.
For good reason - if you prioritize security above everything else, you end up building a rock, as the only system that's perfectly secure is the one that's completely useless and unusable for anything. Adding any feature, any utilitarian aspect to it, means compromising security right there and then. Security is never the goal, it's always an unpleasant cost to pay on the way to the goal.
Security management services balance confidentiality, integrity and availability. Spending more on security means you can have great availability despite the measures on integrity and confidentiality.
Look at any cloud provider. They get it right because they employ the best security management systems.
Look at any cloud provider except Microsoft. I remember three breaches where hackers got to the control plane relatively easily in the last years alone.
Some examples:
https://www.theverge.com/2023/8/3/23819237/microsoft-azure-b...
https://www.theverge.com/2023/9/6/23861890/microsoft-azure-d...
https://www.reuters.com/technology/microsoft-warns-azure-cus...
https://www.bleepingcomputer.com/news/microsoft/microsoft-st...
Well, I'd prefer incapable people to build secure rocks over them building insecure non-rocks.
That doesn’t seem like the main problem to me. The original comment seemed more on point; it is for most companies a sideshow that makes no money and only works to enable their main business. That it gets a bad priority in the budget is a result of that underlying problem.
It's an insurance. Nobody likes paying insurance bills. Being on the defense side of cybersecurity means that you are permanently on the back foot, not a pleasant position either. And cherry on the cake, you spend most of your time cleaning up other's mess (CVEs, users being users...).
I'm pissed this is accepted as normal for the IT sector, while in railroad engineering and aviation (where human lives are at stake) you'd get your licenses and certificates revoked. Therac-25 something.
Security != safety. Safety in civil engineering and aviation is paramount. Security is an annoying, bolt-on side issue at best, nonexistent typically (e.g. railroads).
Therac-25 was a safety event, not a cybersecurity event.
IT security is a thing at all because software safety is near non-existent.
How are you going to retain safety in a compromised software system?
You don't? Safety is not having that compromise in the first place.
Like, if the code can handle all input correctly, then there is no exploit path. Regardless of whether the input comes from an attacker or not.
You said "security is a thing because safety is nonexistent". This means that, if you had safety, you wouldn't need security. I'm asking you to explain how a perfectly safe system wouldn't need security, as someone who compromised it would be able to simply undo all the safety.
How do you compromise a safe system?
Say I wrote software to control a gamma ray knife, it's perfectly safe and it always does the right thing and shuts down properly when it detects a weird condition.
Compromising it would simply be a matter of changing a few bytes in the executable, or replacing the executable with another one.
This seems so obvious to me that I think you may have non-standard definitions of either safety or security.
The executable is part of the system that's supposed to be safe. That you have no means to modify it is an aspect of safety.
With your example, imagine that program would be running on an AVR with boot fuses burnt.
Ah, there's the non-standard definition. Safety means that the system performs as designed while the design invariants hold. Security means someone malicious can't change the invariants.
Cite your standard.
Nah, I'm OK.
If you know it better, enlighten us.
I comment for fun, and this thread has stopped being fun.
How could it be any other way? There are probably some definitions out there, but what 'stavros said is pretty much what the words mean.
That's not what it is about. If someone calls you "non-standard", you challenge them to identify these standards. If you call me wrong, at least give it hands and feets.
That AVR can still be manipulated. If your definition of safety includes preventing in-person attacks on the data storage, then you pretty much need armed guards.
If that's the standard, then no wonder "software safety is near non-existent".
You aren't, for the same reason you aren't going to retain safety in an airplane or a nuclear reactor when men with guns are shooting people and pushing random panels (and/or the other way around).
Even with "defense in depth", there's clear separation between parts that do the important stuff, and parts that protect the parts that do the important stuff from being used against the rules.
I'd go as far as dividing cybersecurity into two major areas of concern:
1) The part that constrains software systems to conform to some make-believe reality with rules stricter than natural -- this is trying to make the abstract world function more like physical reality we're used to;
2) The rules and policies - who can access what, when, why, and what for.
Area 1) should very much be a bolt-on third-party thing everyone should ideally take for granted. Area 2) is a responsibility of each organization/project individually, but it also small and mostly limited to issues specific to that organization/project.
It maps to physical reality like this:
Area 1) are the reinforced walls, floor and ceiling, and blast doors that can only be opened via a key card[0];
Area 2) are the policies and procedures of giving and revoking keycards to specific people in the company.
--
[0] - Or by crossing some wires deep in the reader, because accidents happen and cutting through blast doors cost money. I.e. real-life security and safety systems often feature overrides.
Also security attack in those engineering fields are not nearly as scalable as attack on computer systems. So you don't have as much need to cover every single hole because the damage won't be as much.
You're confusing a statement of the way the world *Is* as an endorsement of the way it *Ought* to be. Ask yourself this: WHY do you get your licenses and certificates revoked in railroads and aviation? Because without that threat of punishment, the railroad and aviation companies would choose to spend their money on other things that are their actual business and not on the distractions that safety and security are otherwise. It takes the force of law to mandate that the companies do something that is contrary to their actual interests and goals. See also Boeing.
Is that true? The safest train is the one which is stationary. Cut off the wheels, and drop the rail cars on secure foundations (carefully) and you just protected yourself from 90% of possible accidents. If you remove everything flamable and weld the doors shut you got rid of 9% more.
Do you see why this is silly? Because the main business of rails is to transport people and stuff. You won’t be railroad engineering long if you don’t keep that in mind.
I couldn't disagree more. Defenders and attackers are alike in many ways. I disagree with the post as well.
Mature security teams for example use Bloodhound which uses neo4j to visualize attack paths in AD. Defenders (good ones) don't think in lists.
Yes, it is. Obviously!
I'm sorry, but what else are defenders trying to do that isn't defense? are all defenders completely incompetent then?
Yes, and there are people in mature security teams whose entire job is to search for and stop (not just react to alerts) attackers.
I think you have an incorrect perception of what security teams do. It is both a matter of strategy and resources. There are security teams whose budget is in the 100's of millions of dollars and who employ some of the brightest cybersecurity strategists and professionals. You rarely (if ever) hear their names in relation to a breach or compromise. There are also much less capable security teams who do well against most attackers, but will inevitably get pwned by an APT, except the good defenders catch the apt's before they cause significant damage.
At well protected organizations, attackers lose 99.9% of the time (probably higher, I'm guessing here). Attackers simply need to win once to succeed, while defenders need to succeed 100% of the time.
> I'm sorry, but what else are defenders trying to do that isn't defense?
This is an uncharitably narrow reading of the post to which you're replying, isn't it? Defenders are trying to ship. To make money to make payroll. Create profit centers, not cost centers.
You can say that security is a feature and a load-bearing one, and I'd agree with you, but not everyone who makes decisions will do the same.
You're wrong, defenders are not profit centers. You don't expect the security guard for your office building to generate profit, why would you do so for your digital assets? defenders are like lawyers and hr, they are cost centers whose existence is justified because attackers also exist.
Maybe it is, but I wouldn't put it that way. Security teams exist because people with bad intent that want to harm you exist. Just like lawyers exist because people who sue you (including the government) exist.
Imagine stating "lawyers don't exist to protect from lawsuits", that's how it sounds to me. If defenders aren't there to defend, then their existence isn't justified.
Defenders are there so that when other teams who "ship" attempt to do so, they don't get the application, system, company or wherever you have protected data doesn't get compromised. And this is before and after "shipping" or deployment. Security is a cost of business, whose RoI is measured by the fact that you are doing business without getting hacked, nothing more.
Yes, that's why companies cut cost on security guards as much as they possibly can. From the product-making company standpoint security is a mostly a cost.
Yes it is mostly a cost. Breaches are also a cost. When the homedepot security team tried to fix the issues that got them pwned, the execs said "we're not a security company, we sell hammers". Box ticking mindsets like that are held by incompetent and short sighted executives. The cost of security is decided by the cost of a potential compromise, it has nothing to do with profit margins. A lot of companies learn this lesson the hard way. Many "snakeoil" security companies exist because of this incompetent line of thinking by executives. It is easier to say you paid some company who made some b.s. claim than to actually fix problems, even if the 3rd party costs more than the cost of fixing problems.
In short, what you and OP commenter describe is incompetency, it should not be taken as the default, those are not defenders, those are mismanaged organizations. We're in 2024, every exec should know better.
> We're in 2024, every exec should know better.
"Should" doesn't mean much. People respond to incentives. Can you explain the incentive function that exists today in the real world to prioritize the security cost center above the profit center?
I mean, I work at a company that I'd say does a pretty good job of this--in a regulated industry and after getting burned a few times. But you can still go full-send with VP approval, and the risk becomes part of the cost of doing business.
the problem goes even deeper, execs chase short term profits and stock ticker bumps, that's the root cause in my opinion. You shouldn't prioritize security over the main business and profit, that was not my suggestion, but you should prioritize long term profits and reputation (ability to make even more profits in the long term), which is where security comes into play.
In other words, security is necessary for business. Just like how you would want your offices secured from burglars -- because otherwise you can't do business well -- you should want your digital assets secured from hackers, except unlike physical security, it isn't just local malicious actors and competitors after your business but intellectual property thieves, hacktivists, financially motivated cybergangs and more (not just nation state actors).
Failure to give proper priority and funding to cybersecurity, is failure to ensure conditions that make the company profitable and viable in the long term.
Everything in life is a trade off, and no-one is in the business of perfect cyber security defense. Therefore, businesses will *always* trade weaker cyber security defense for better/faster/cheaper/easier/more business in their actual line of business. Just like you do every single day. Do you have ALL traffic on your home network encrypted with mutual serve and client certificate verification? Do you only have your 256 character passwords memorized in your head and not stored in a password manager anywhere or otherwise recored somewhere? Are all of your home systems equipped with strict outbound firewall rules that only allow one time, on demand and confirmed communications with the wider internet? Have you hardened your home network against data exfiltration via DNS queries[1]? If you use 2FA for your accounts, and the objectively weaker password managers to store your passwords, are your 2FA tokens kept on completely separate devices from your password managers? Do you only allow direct console access to any of your systems and have no remote access like SSH enabled? Do you a have every single computer backing up their data into multiple redundant copies, without using the network for data transfer and with at least one if not more of those copies stored off site?
If you answered "No" to any of those questions, you also have chosen the route of "incompetency" and "mismanagement". It's 2024, and every IT person should know better. But of course we do "know better" and choose the objectively weaker options anyway because the stronger options get in the way of actually doing the things we want to use our systems for. You don't choose perfect cyber security defense for your home network because you don't have a home network for the purpose of practicing perfect cyber security defense. So it is with businesses, they don't have their systems for the purpose of practicing perfect cyber security defense either.
[1]: https://www.akamai.com/blog/security/dns-the-easiest-way-to-...
> You're wrong, defenders are not profit centers. You don't expect the security guard for your office building to generate profit, why would you do so for your digital assets? defenders are like lawyers and hr, they are cost centers whose existence is justified because attackers also exist.
I didn't say that infosec was a profit center. But they're in tension with profit centers for attention and sway, and by the way--the profit centers are the ones who make money.
I've said it before, I'll say it again: People Respond To Incentives. Lawyers and HR are generally not respected except insofar as they protect companies from visible legal risk, and often not even then. Infosec is so vague as to appear as a tiger rock to people who aren't plugged into it.
> Defenders are there so that when other teams who "ship" attempt to do so, they don't get the application, system, company or wherever you have protected data doesn't get compromised.
Everyone, infosec included, is trying to ship. Shipping is how you make money, make payroll, and keep people employed. You only don't ship when your risk calculus indicates that the cost of not shipping is less than the cost of shipping.
This us-versus-them thing brings us back to "the most secure system in the world is in an unplugged box". But we don't operate businesses off of unplugged boxes. Risk management exists. If this is how you would argue risk management with the median exec I've known, you'd lose. I have skilled infosec friends who've had better success than this through wise process and product choices, though.
You've misunderstood me. Defenders aren't the "cyber security team employed by AT&T to keep customer data secure". The Defenders are AT&T, who would rather spend their cyber security budget on just about anything else that could actually generate a profit. The cyber security team that AT&T hires might have the sole job of building the most robust defense system imagined, but even if they do, their efforts will be continuously stymied and reduced because true, complete, robust security will get in the way of actually doing the things the AT&T wants to do.
Or to put another way, a company that spends all their money on perfect cyber security is as useful as the proverbial perfectly secure computer encased in concrete and buried a mile underground with no power or network connections.
But that's false equivalency. The attackers also work for organizations. It is a bit rare for individuals to hack companies these days. APTs are teams, sometimes they are employed by intelligence or military units of countries, other times they are employed by a criminal organization and yet other times they are loosely formed organizations between individuals with a financial or political goal, like hacktivists as an example. But they have hierarchy, motive, goals, even a work schedule and paid vacations and bonuses.
Even for individual hackers, there are individual good hackers (commonly called "whitehat" although I deride that term) doing bug bounties and finding CVEs.
The main differences between attackers and the attacked are intent, resources and which side you're on. The NSA and CIA are the good guys from my perspective, but they are the bad guys for defenders working in Russian or Chinese government cyber defense teams.
You've missed my point or I wasn't clear enough. It doesn't matter that they're part of a larger organization. That organization's goal is attacking, or at one step removed, selling/using the resources gained from attacking. Defenders are never in an organization whose business is the Defending.
Or lets use your CIA example, and for the sake of argument, lets pretend there are no other counties in the world other than the USA, Russia and China. In a world where there are no Russian or Chinese Attackers, the CIA would not spend money on defense against Russian and Chinese attackers. But in a world where there are no defenders in Russia and China, the CIA would still spend money on attacking and exfiltrating data from Russia and China. They would just be vastly more successful at it.
Or as a different analogy, mining companies mine because they want to sell the ore and gold in the mountains. But we still call them "minim companies" because thats their job. And they are often opposed by environmental groups working to defend the mountain. In a world where there were no mining companies, no one would be organizing an environmental group to defend the mines because there's no gain to spending time and resources standing around and guarding mountains and ore that no one is trying to get access to. But in a world where there are no environmental groups, there would still be mining companies.
There is also Fix Inventory, which is a graph-based security tool:
https://github.com/someengineering/fixinventory
I'm one of the people behind Fix Inventory. What scares a lot of developers away from graph-based tools is the graph query language. It has a steep learning curve, and unless you write queries every day, it's really cumbersome to learn.
We simplified that with our own search syntax that has all the benefits of the graph, but simplified a few concepts like graph traversal.
Defenders is referring to the entire org, not just the security team.
Cybersecurity being a sideshow to the main event is a brilliant way to frame the problem.
It also explains why companies rarely get punished by the markets for data breaches.
It’s firmly in the “cost” center.
That’s a worse framing than above. It doesn’t matter if it’s a cost or a profit center. It’s part of a trade off.
You could achieve a perfectly secure system, if and only if you make that system do exactly nothing. If you want to achieve any other outcome you will have to trade some measure of security for the ability to do anything. Or as Matt Levine so aptly put it: the optimal amount of fraud is non-zero
Indeed. But I’m pointing out if it’s not the goal, then it’s a cost to minimize to achieve the goal.
Thing is, it's not a problem. A problem would be if cybersecurity was playing first fiddle.
(When concerns of security become the main worry in an organization, the term we historically use to refer to it is "police state".)
Isn't a police state where a government is concerned with security above all else? To my mind, a place where private organizations are above all concerned with security is the exact opposite, anarchy, since there's no collective security framework in place to take the security burden off private organizations.
Police state on the inside, anarchy on the outside. This makes it even more similar to governments - sovereign nations are the highest organizational level; beyond them, there's no one to defer to. International affairs is anarchy - everyone's pogo dancing (to the tune set by nuclear powers).
This seems like a serious misconception. Cyber attacks absolutely have purpose, whether that’s to steal data, disrupt services, whatever. Your viewpoint might apply to unsophisticated actors who just want to break things and cause chaos, but it’s completely ignorant when considering nation-state actors and financially motivated criminals.
Yes, but that purpose is accomplished by way of attacking the system. By comparison, most cyber security defense gets in the way of the purpose of the defenders. We know this, and even joke about it openly. The ultimate secure system is a computer unplugged, sealed in a lead vault, encased in concrete and buried a mile beneath the surface. It might not be useful, but it is completely secure.
Even less flippantly though, we inherently know this. How many things do we do every day that could be "more secure", but "more secure" gets in the way? Do you use memorize 256 character unique passwords for every site and system and refuse to record them even in a password manager? Do you use GPG encrypted emails and only E2E encrypted messaging services? Are all your home network devices independently fire walled, with strict in AND outbound rules ensuring they can only talk to the specific devices they should be able to talk to and only on specific well defined ports? Have you hardened your home network against data exfiltration via DNS queries? Is all network traffic fully encrypted with mutual client and server cert validations? If you've answered no to any of these questions, you have chosen to prioritize something else over better cyber security defense. And it's probably a good bet that at least some of that is because doing these things would actively get in the way of doing what you actually want to do with your electronic devices. You've knowingly chosen a weaker defensive stance to do something else instead.
Attackers on the other hand have no need to choose weaker attacks on your defenses in order to do something else instead. The attack is the point of their usage of their devices (and yours).
You might argue that the attacker might choose a lesser profile in order to remain hidden and beneath detection, but I would argue this still isn't the same choice. Given the option, no company would spend any time or money on resources for cyber defense. They would rather spend all that time and money on their actual business. But Attackers would spend time and money and resources on their attacks because those attacks directly serve their goals.
To add to this: I get irrationally irritated when some hack occurs and someone makes the comment: "Their databases weren't even encrypted! Amateurs!"
Okay mister wise-guy, let us see you "encrypt" the database at an organisation where that database produces a billion dollars of revenue annually.
Are you sure you aren't going to lose the encryption keys? Many billions of dollars sure?
Okay, you've made sure that the keys are safely backed up! Good job! Now rotate them. On a schedule. That's a process you will be required to hand over to a secops team to avoid you being a "bus factor of one". Good luck with writing out that process so nobody ever screws up.
Now provide access to the encrypted data to... everything and everyone. Because that's the point of business data. It's supposed to be consumed, reported on, updated, saved, exported, imported, and synchronized. Not just to systems you control either! To the CFO's tablet, to the third-party suppliers' ERP, and to every desktop in the place. There's a hundred thousand of them, across every content bar Antarctica.
It's surely because they're amateurs that they haven't figured this all out already: cheaply, robustly, and securely!
It's never the encrypted database that gets hit, it's always the other database that was made because our first database was encrypted....
And the reason it was made is because the encrypted database may as well be a shrine to a dead god; it makes you feel awe, but it's otherwise completely useless.
I mostly just see "not even encrypted" by way of password stores and PII though — stuff no employee or CFO is ever going to need to visually examine — and those we have a lot of best practices to fall back on about keeping always encrypted all the time.
Attacker purpose is perfectly aligned but defense may not align with tons of things like user convenience or ease of development
If cyber defence is a sideshow to the actual businesses objectives, then surely the same holds of cyber attack and whatever the actual criminal/strategic goal?
Not at all. The attack is directly inline with the goal of getting to whatever is at the other end of the attack. By contrast, nothing about SSL certificates, forward secrecy, encryption at rest or authentication and access controls is inline with the goals of say Facebook to deliver as many cat pictures and political memes to you as possible, and as many eyeballs to advertisers as possible.
Or put another way, in a world with 0 cyber security attackers, there would be no money or time spent on cyber security defense. But in a world with 0 cyber security defenders, there would still be people attacking resources and taking things the owners would rather they not have.
Cyber attacks are in the same position as sales in most orgs: they can focus on getting other people's money and some failure rate is acceptable as they don't get paid much if they don't succeed.
The org can invest as much as they bring in, they're a profit center, where defense is always a cost center that will be reduced to the minimum acceptable.
For cloud providers, security is their raison d’etre. On the cloud you can have confidentiality, integrity and availability that was unheard of two decades ago.
No, it's not. Cloud provider's raison d'etre is selling access to compute resources. That confidentiality and integrity are resources they can also sell does mean that they might spend more on those things than would otherwise be expected but if their single and sole purpose was security, they would't be selling networked access to computer systems at all because that is objectively less secure than physical terminal access. But no cloud company that requires their customers to staff a physical presence at a terminal in the data center is going to be as successful as one that allows you to remote into your cloud from anywhere, even though tht is objectively less secure.
Nowadays their purpose has some sort of monetization component, therefore there is consideration as to which attack vectors seem to be the most likely to lead to the kind of a monetization scheme they are targeting on. For example does a group of attackers ransoming companies prefer the same attacks as phishing individuals? Are these the same companies / groups (I prefer companies at this point, they are organized crime, they are a company and have the same sort of problems in that any small company have in deciding where to put their resources - we don't have a phishing division here, we ransom data, we don't denial of service - nobody is paying us for that, we ransom data and that's it!)
Sure, the final business goal is selling access to the resources gained by the attack, but ultimately the attacking IS aligned with/directly enables that goal. Defense in cyber security is almost always at odds with the goals of defender's business. Or put another way, if there were no Attackers, no one would spend any money on cyber security defense. But if there were no Defenders, someone would still be paying for cyber security attacks.
This is well put.
I think one way to drive home the point is defenders are cost centers and attackers are profit centers.
This is exactly right. There's also the underlying asymmetry; defenders need to get everything right, attackers only need one vulnerability. (Which is usually human behavior based.)
Is that a joke? Microsoft seems to be in the advertising business. Their OSes are also a means to an end.