Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by lowbloodsugar on Thursday June 24, 2021 @02:17AM (#27614516)

Unless this is literally running on a single 1U host in some colo, there is no excuse for not having defense in depth. An old school DMZ if you are in a datacenter. A VPC if you are on the cloud. Then client certs for everything. Two factor for ssh. Auditing. These are straightforward to set up, with different options if you have time-but-not-money or money-but-not-time. If you have not-money-and-not-time then this is probably going to end badly no matter what.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by lmm on Thursday June 24, 2021 @02:27AM (#27614548)

> there is no excuse for not having defense in depth. An old school DMZ if you are in a datacenter. A VPC if you are on the cloud. Then client certs for everything. Two factor for ssh. Auditing.

Maybe there is no excuse, but literally every company I've worked for (including Fortune 500s) has been missing at least one item from your list. So "industry best practice" means committing less time and money than it would take to implement all those things properly (rightly or wrongly) and you need to triage and prioritise.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by lowbloodsugar on Thursday June 24, 2021 @09:27AM (#27617074)

So the excuse is "my company doesn't take infosec seriously". Like every similar issue of "should do but don't" (testing, formal promotion processes, diversity, harassment response), you get to decide to tolerate it or get a job elsewhere. My experience is that the companies that take this stuff seriously also do a better job of converting my skills into cash, and as a result, pay me better.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by lmm on Thursday June 24, 2021 @09:17PM (#27626063)

Interesting. My experience is that companies that "move fast and break things" have been better at making money and paying me (whereas I personally lean too far in the perfectionist direction). Interesting businesses face a wide range of risks - competition, regulatory, market - and infosec is rarely the biggest one IME.

[ Parent | on HN ]