Schneier on Security

Clive Robinson • November 4, 2024 11:05 AM

First thing to remember,

It’s not just China or the other four horsemen of the axis of evil.

Yes China, Iran, North Korea and Russia are all at it as are Brazil, India, and other fast economic developers.

Oh and don’t forget every country in Europe, and East of the Mediterranean.

Where it’s not just Nation State SigInt agencies, it’s private corps funded by Venture Capital Investors.

Why, because there is a very great deal of money to be made selling technology and information on what most would consider at best questionably legal if not downright illegal markets.

Thus some are going to ask the obvious question,

“How to stop it and it’s risks?”

The answer is,

“If you have any external communications, all connected systems are vulnerable, beyond your capabilities to stop up the weaknesses on them all.”

Thus you have to develop a minimal connectivity policy and look up the old DMZ and Hardened Bastion Host stuff for a few historic foundation lessons. With any connected systems not having any sensitive or mutable information.

Then you need to “instrument” in ways an attacker can neither see or sense. Oh and have well developed “fast shut off/down” in place driven automatically.

Oh and as for “risk based prioritizing” a lot of alleged gurus talk about… Forget it, outside of “smash and grab” and allied “ransomware” you are very unlikely to know what your attackers real priorities are… So how can you see what risks they present and how to best mitigate them.

You are better advised on “bang for the buck” the top levels of which unsurprisingly tend to appear in the top five or seven industry “Best Practice” risk “priorities lists”…

The other priorities can be found in a more general form of “physical” rather than “information” security.

The two best bits of advice for “information security” are actually,

1, Don’t connect (Isolation / segregation).
2, Shovel S41t fast.

The first is “mitigation by Isolation / segregation” and unlike those expensive “firewalls” and similar bet devices will slow down or stop a “fire ship” attack.

The second is predicated on the unfortunate truth that all your consumer / commercial software from the boot ROM upwards at best stinks. Because it almost certainly has more holes than certain maggot infested cheeses that originate coincidentally in Italy (where a lot of commercial espionage tools originate).

There are a lot of lessons to be learnt from “physical security” and if you understand them you can pivot the knowledge into quite a chunk of “information security” (which in many cases is what the attackers are doing).

Clive Robinson • December 19, 2024 1:42 AM

@ t33l0, ALL,

With regards Sophos putting malware on users systems.

Firstly this is “We’re the Good Guys” nonsense various governments use to spy on other governments, yet condemn those governments when they spy back.

But consider further, such software allows not just “files” to be looked at but altered or even created.

Such has been used by ransomware operatives for several decades.

But more recently Apple got into hot water over “on device” scanning supposedly to find CSAM. As was pointed out by many at the time, the scanning could “scan for anything”.

It also in effect constituted an “illegal search” but… This is where we get the “human eyes” nonsense as to if it is a search or not (something that really needs to be killed off).

The simple fact is encouraged by those in Law Enforcement and other local, state and national government agencies “the courts” are destroying the core fabric of human society.

We know where this goes, we have quite a bit of history from the end of the last century, a look at East Germany prior to the fall of the Berlin Wall gives plenty of detail.

There is a little known fact that we have to have crime to show that there is a need to have people investigate it and most importantly round up the law breakers.

Unfortunately some see “investigation” as being the sole reason, as this enables “Power to be accumulated”. Such people are not just anti-social they are with little doubt evil.