Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
What You Need To Know About Nation-State Hacked Hard Drives
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
3/12/2015 | 10:48:43 AM
Re: Changing behaviours regarding security
I like your not-dated analogies, @jamieinmontreal. You are so right about the balancing act between security and convenience, and the ultimate changing of habits. And you're right--some level of fear is a great motivator.
jamieinmontreal
jamieinmontreal,
 User Rank: Strategist
3/12/2015 | 10:36:44 AM
Changing behaviours regarding security
@klevkoff117 I'm not necessarily dating myself with this analogy (I hope) but when I was a kid we left the house doors unlocked at all times... it just never occurred to us that locking them was necessary.   Kids were left in cars, often with the keys hanging from the ignition and car doors also unlocked.

Times changed and we became more aware of terrible and tragic incidents we started to change behaviour "just in case".   Doors started to be locked, security chains were installed, we learned to ask who was there before opening doors.

It feels like the world is slowly learning these same habits in regards to their Valuable Blob Of data (VBOD), now we install AV at home, we are less inclined to plug random USB devices into things (a lesson which will very likely be summarily ignored the first time a "really useful" IoT type device is issued with a USB Charger) and we don't "just click OK" on random messages - at least not all the time.

As far as ROI for security is concerned it's implicit - why do we buy insurance after all?   it's simply a measure of security against the threat of physical or financial harm.   

If all of this is true then the battle is between fear and convenience.   Fear can be created or developed and can be a powerful motivator - parents leverage it all the time (if you don't believe me, read Hansel and Gretel again).  

However, desire for convenience is a really strong mtivator as well; to paraphrase an old saying, necessity is the mother of invention - convenience is the father.   We needed to make things faster, more accessible and we wanted to do it the easy way.   

So the initial fear surrounding something has to be amplified many times to overcome the natural inclination towards inertia - look at campaigns for wearing seatbelts, putting on sunscreen, not smoking in bed (somewhat older reference to be fair), or indeed not smoking at all... Once the inertia has been overcome and action has started, the new habits will form and they will be hard to break - when was the last time you saw a "wear your seatbelt" campaign?

As we read more and more about data breaches and many other concerns look for firms to start locking everything down and managing access even more tightly - once that starts it will be unstoppable and while there will always be exceptions (does everyone always wear a seatbelt?) the habits will be formed and they will define the newer world.   The winners will be those that have developed the means to allay the fear in as easy a manner as possible.

 
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
3/7/2015 | 11:34:32 PM
Re: Maybe the problem is too much flexibility
That's beautiful, man.  I agree with Marilyn; you should be in marketing.

Unfortunately, marketing ROI and security ROI are very tricky to determine and justify.  It's all about UX these days -- even though nobody in the room at the UX meetings is a "U."
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
3/6/2015 | 12:09:30 AM
Re: Infected conference materials
Scan everything.  :)
Joe Stanganelli
Joe Stanganelli,
 User Rank: Ninja
3/6/2015 | 12:08:11 AM
Re: Infected conference materials
They do make good gifts, though.  One Christmas, when I was stuck for a Christmas present for someone, I gave them one of my free mega-storage USB sticks from a conference.  They loved it.

Maybe they're hacked now.  Who knows?  :p
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
3/5/2015 | 11:10:50 AM
Re: Maybe the problem is too much flexibility
Great idea  @klevkoff117! You should be in marketing! But seriously, I look forward to the day that strong security is a product differentiatior -- in finance and other industries..
klevkoff117
klevkoff117,
 User Rank: Apprentice
3/5/2015 | 10:36:39 AM
Re: Maybe the problem is too much flexibility
I think a lot of that problem simply comes down to how institutions interact with the public. Most people I know really do care whether their bank account is safe or not - and would probably respond favorably if their bank actually told them "our account summary page isn't especially pretty, but it's much more secure than our competitors". However, that doesn't happen - presumably because somewhere there's a web designer who's worried that their competitors have pretty 3D mouseover buttons and they don't.

Perhaps it would be more useful for them to educate their customers rather than to always play into their least little whims and desires. (I'm imagining a variation of the old Volkswagen commercial... "Our website is ugly, but our security is better, so we can offer you a credit card with a lower interest rate, and pay better interest rates on our accounts; we think the tradeoff is worth it - don't you?" I know I'd move my accounts there tomorrow - if I actually believed the pitch :) )
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
3/5/2015 | 10:26:41 AM
Re: Maybe the problem is too much flexibility
@klevkoff117-- It's  certainly not a new problem. And hats  off to whoever figures out the right balance between user convenience and security .
klevkoff117
klevkoff117,
 User Rank: Apprentice
3/5/2015 | 10:24:58 AM
Re: Infected conference materials
I think a large part of this is our modern obsession with convenience and looks.

My bank tells me that I should have the latest browser "so I can enjoy the latest features"; if they wanted the best security they would be telling me to disable JavaScript and Active-X - and using pure HTML. Likewise, does anyone here remember when, if you had a bunch of text to deliver, you did so as a plain text file? A pure text file isn't especially pretty, but you can't practically infect it with malware.

The simple reality is that nobody wants to trade away convenience, or the latest whiz-bang features, for real security... and so the endless quest for good security that is also convenient, cheap, and looks pretty... which is probably just not possible.

Obviously the promoters of that conference had no idea that anyone would want to hack their conference materials. Otherwise they could have put all their conference material into an archive on that CD - and then published the MD5 hash for the archive on their website.

Likewise, another reader posted about, while conducting business at a bank, being permitted to print something through their network off a USB stick... and how this was a rather unsecure practice. Am I the only one who remembers when even HAVING a USB drive in a computer that was supposed to be secure was considered a bad idea?

We sacrifice security for convenience at every turn, then we act surprised when we learn that the security isn't there any more....

 
klevkoff117
klevkoff117,
 User Rank: Apprentice
3/5/2015 | 10:11:23 AM
Maybe the problem is too much flexibility
I'm sorry, but maybe it's time that people just plain grow up. There is an easy - and 100% effective - solution that can be implemented for just a few cents that will prevent anyone from hacking the firmware on your hard drive. Simply attach a physical switch to the physical write-enable pin on the BIOS storage medium; this way, it will be impossible to alter the firmware without physical access to the drive. Many years ago we had an antiquated version of "flash" that was 100% un-hackable - it was called a ROM (read-only memory); since a ROM cannot be reprogrammed, the only way to change the code stored on a ROM is to physically replace it with a new one..... so it's totally secure... and securing your hard drives is as simple as locking the server and posting a security guard. Do we really need the ability to field upgrade the BIOS on a hard drive? If not, then a ROM will do just fine.

Now, I realize that people these days are obsessed with convenience, and nobody is willing to accept the possibility that a product should be correct the first time (and so require no updates), but it seems to me that it wouldn't be a hardship to simply ship hard drives which physically cannot have their firmware or BIOS altered after they leave the factory. (Use a ROM, cut off the write-enable pin, or burn a link to disable the program function.)

The vast majority of the security breaches and hacks we're seeing lately are simply the result of our modern obsession with convenience... 

(And let's not even discuss passwords which can be reset after a simple request to do so. Am I the only one who sees the irony of generating a "password reset token", which is secured by a nice long cryptographic hash, then sending that secure link to an unsecured e-mail account, as a plain old unencrypted e-mail. Gee, guys, if you want real security, maybe you really should have to go into the branch and talk to someone in person if you want to recover your lost bank password. )

 

 

 

 

 
Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.