Honestly: fuck corporate security and leadership who kept pushing for spying on their workers with increasingly intrusive tools. I can’t remember how many times I argued with IT that MITMing SSL was not ok (there are some tools.. crowdstrike maybe? That do this). They made their bed, now they gotta sleep in it.

MITMing SSL is also Zscaler's MO, and guess what my job is preparing to mandate.

Organizational endpoint security seems to be much more about incident response than incident prevention. That is, it's more focused on providing a nice audit trail that can be used to find and fire/arrest the perp once a breach occurs than it is at preventing breaches from happening. It probably fills a due-diligence tickbox somewhere, allowing the company to say "if a breach occurs (the probability of which is always nonzero) then we have measures in place to find out how, where, and by whom and mitigate the damage" to shareholders and important customers.

It is not an audit tickbox. It is barriers on the right side of the bowtie, and in the RECOVER dimension of NIST. Here you go: https://zinatullin.files.wordpress.com/2020/12/risk-bow-tie....

I work in corporate security. It's a great gig! MITMing SSL is something I refuse to implement, and argue against in every forum I attend.

It's always interesting to hear people think they have rights on corporate networks.

It is a complex issue with entry of nuance I'm too tired to thumb type. I know there are lines that shouldn't be crossed. But it is so naive to think companies shouldn't have an eye on their data.

Do you think banks shouldn't have cameras in their lobbies? Or that tellers can walk in and out of the vault with black bags and no one ask what's inside?

I don't think the OP's point was about rights as an individual on a corporate network, more about trying to backdoor your staff's equipment and the consequences of that.

To use your camera analogy, you better have a good lock on the security room holding the tapes.

Yes, putting every device in Windows AD and installing remote management tools that run at the system level is a recipe for total compromise.

Software diversity is good. Remotely controlled mono-cultures are bad. IT management and security compliance people need to understand this.

I liken the mindset of (only we will use the remote control software to do good things) to Encryption back doors (only law enforcement will use them to catch criminals). Computer scientists call these 'Exceptional Access Systems' and it has been shown (many times) that it is impossible to ensure they will not be abused and used against you.

Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications:

https://dspace.mit.edu/handle/1721.1/97690

> Software diversity is good

Software diversity also means attack surface multiplication, so it's a delicate tradeoff.

> Yes, putting every device in Windows AD and installing remote management tools that run at the system level is a recipe for total compromise.

What alternatives are there? I honestly don't know

It's not really about alternatives, what would the spyware stop that a simple Daemon that version checks your device won't?

If you're working from home and your device gets owned, and the attacker just sits there slowly slurping data as you go about your business... Chances are you're not going to detect it, but if you did you'd probably notice it's running when it's not supposed to and it's sending network traffic when not actively used.

If someone uses a laptop breach to go look at data you wouldn't normally look at ( or tons of records ) an audit log would give that away.

So really to do security well you have to profile the role. Why are you looking up customer record abc123? Trying to see what your girlfriends doing, or is it because they've called the customer support line?

You basically have to define what does misuse look like and protect for that.

Back on the slow slurp, hardend immutable devices that are regularly updated with limited Auth sessions would likely contain the breach.

Same deal on servers, you harder to stop it, but you monitor for when it happens.

Do people really monitor though? Some, sure, but your average org buys a tool the fails configure it with any sort of context.

In security engineering there's this subculture of individuals that just implicitly trust every vendor that offers a solution because that means they don't have to do their own research on the issue. And if anything goes wrong, just blame the vendor!

I have talked to security engineers that have had the company procure millions of dollars worth of security tools, and yet they don't even know the basics of security.

For God's sake, I had to explain what end-to-end-encryption was to a team of "senior" security engineers the other day. They genuinely had no concept of it. As a security SWE I am so done with these sort of people. Fuck them! Why are they even in security!? Real private data is at risk because of their incompetency!

It is rather appalling. I recently listened to a podcast about a police station in a small city that was compromised and all their data ransomed. They had a contract company that handled all their cyber security needs. The "security" company had an RDP port open to the world to an admin account on the server that ran everything for the police station and city. In order to protect the employees webmail, they required that you login from an internal IP and so they gave this admin remote desktop account credentials to employees that needed to check their email remotely. They could login to the server with the admin account and then use the browser on the server to log in to their webmail. The same set of root admin credentials was given to every employee. It's just insanity. And I'm sure that government contractor was hella expensive.

In case others are curious, that (probably) was Episode 96[0] of the "Darknet Diaries" podcast. Very worth a listen IMO.

[0] https://darknetdiaries.com/episode/96/

From friends and former colleagues I know at least quite a few companies using tools like Tanium [0]. The Tanium client on the employees' machines (and on all corporate servers, containers, VMs) is still based on python 2.7.

It would be interesting to know Tanium takes to backport security fixes. I mean py2.7 was sunset 2020-01-01 [1].

[0] https://www.tanium.com/ [1] https://www.python.org/doc/sunset-python-2/

Many of them the extent of their knowledge is: push a button and run a scan and tell an App or Infra Team: here are your vulnerabilities now fix them. Ask them to dive in a little deeper with you on the vulnerability (Eg past the entry in the spreadsheet they gave you) and they often don’t have the technical ability to do so..

I have built solutions that are a perfect fit to solve security issues at multiple companies, only to have them turned down because “management says we have to buy a vendor for this”. Incredibly frustrating, especially when they go with a vendor that is in all ways worse than the solution I was providing.

I worked at a company where the CIO believed everything vendors told him, and nothing any of his employees told him. He also got lots of kickbacks from said vendors and was eventually perp-walked out of the company.

Same company had a head of security who was full-time employed by two different companies at the same time (he had unlimited vacation time for both) without either knowing the other existed.

Best thing was that the company did investment/insurance services and had a banking division.

> I have talked to security engineers that have had the company procure millions of dollars worth of security tools, and yet they don't even know the basics of security.

When I was in college the whole student network went down. Apparently there was a hack from the student network to the campus police network, so campus IT pulled the plug on any of us having network access. Because those two weren't separated because why would they be?

So I hoofed it to the IT department and I asked to talk to someone who knows a thing or two about networking. The director of IT came out. He sat me down and started telling me about the $300,000 budget he just got approval on. I was thinking, you can't take some of that and stand up a router with packet filtering to isolate the student network from the police network in two different subnets? A FreeBSD box might do in a pinch. (It was the early 2000s and network traffic loads were... different.)

I learned a lesson that day about seniority and the Peter Principle. Climb high enough and your mindset changes, from technical solutions to issues of money and resource allocation. From there, "let's just pay $VENDOR to do it, they'll solve the problem for us" is but a small step.

There's a mix of "The Peter Principle", lack of experienced engineers, too expensive to acquire engineers, at play in the IT world. But as far as I recall that was always the case.

I'm not sure that "security engineer" would be an accurate term to describe such a person.

Bill Demirkapi posted an update later that this earlier assumption was perhaps incorrect [0]. It seems an internet-routable RDP server at rdp.chrisro.fun ("chrisro" is apparently named after the specific Okta employee/contractor whose name is visible in screenshots) is a more likely vector for compromise.

0: https://twitter.com/BillDemirkapi/status/1506123471352438784