Kate Temkin ????❤️
I swear, half the CVEs I hear about are “if your computer is connected to the internet and someone sends you a text message, they now have your power of attorney”
and the other half is “if a trained thief were to sneak into your house and replace your hard drive with an identical copy, an attacker with an exact predictive model of that drive could interrogate the SSD wear leveling algorithm and reduce the search space for your bitlocker password by up to 12 bits _without you even noticing_”
timthelion
@ktemkin You forgot the 30% of CVEs which are 'if you turn on these three flags that were deprecated in 2009 and point your program at a non trusred server the program would run slightly slower. LOOK ITS A DOS ATTACK CAN I PLEEZZ HAVE A CVE ON MY RESUME PLZZ!!!!'
mcv
Rich Felker
@bob_zim @mcv Firewalls/routers also have no access to any data only minimal metadata, unless you're doing something horribly wrong. I would classify an attacker getting root on them as DoS or in the case of firewall, slightly more favorable ground to launch further attacks from, not critical.
Zimmie
@mcv I had to fight that fight when Spectre/Meltdown were the shiny new flaws. “We need you to prove the firewalls and routers aren’t vulnerable to Spectre/Meltdown!”
That whole class of flaw requires the ability to run code on the target system. If somebody who isn’t on my team can run *any* code on our firewalls and routers, we have much bigger problems.
fedops 💙💛
@dalias perfectly illustrates the schism in IT security orgs. This has been normalized in recent years, basically because people are out of ideas how to prevent phishing attacks from succeeding on completely patched endpoints.
@bob_zim @mcv
Rich Felker
@fedops @bob_zim @mcv By (1) not having employees possess phishable authentication secrets, and (2) not using a common communication medium for org-internal and outside-facing comms. This is not rocket surgery.
Rich Felker
@fedops @bob_zim @mcv I call those middleboxes not firewalls, but whatever you call them, in my book their presence is a critical in the audit report. 😈
fedops 💙💛
@dalias every corporate firewall I've seen in recent years is configured to break open TLS streams and inspect the contents. So I think it's fair to say that firewalls are the single most valuable point of attack in the network.
Or indeed outside of your network as the same is true for zscaler.
@bob_zim @mcv
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.