Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by azurezyq on Friday September 15, 2017 @09:04PM (#15262147)

"All binaries are audited and signed.", which makes it trackable. And the runtime environment is also isolated and uses different set of access permissions. I'm not saying it is impossible. Just layers and layers. For internal stuffs, Google's beyondcorp is a good start.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by sillysaurus3 on Friday September 15, 2017 @09:35PM (#15262286)

There is no such thing as a runtime environment that (a) attackers gained RCE into, and (b) the box with the sensitive data can verify the incoming connection is from an audited, signed binary.

Simply put: if you have RCE into an app, then that breaks all the guarantees of that audited, signed binary. You can make it sing and dance and ask for a thousand rows instead of ten; you can do whatever you want to it. The modifications happen in memory, not on disk, so even if they don't persist you can still modify the app.

Monitoring seems like the only solution.

[ Parent | on HN ]