The next few weeks are going to suck if you work in IT or security. Buckle up folks.
I predict that we’re going to see two patterns emerge:
First, we’ll see a large percentage of teams built on huge budgets and flashy tools crashing and burning in their response. 1/
Second, we’ll later learn that while tool heavy teams are imploding like dying stars, apparent-underdogs will be crushing it, rebuilding where necessary, and securing their networks.
The difference between the two? The former only really learned how the tools work. 2/
But because the tools abstract away details, many don’t know how to do what the tool actually does (or don’t know it well). And this doesn’t really matter until you can’t use the tool for some reason.
The latter teams are strong on fundamentals (they have to be). 3/
I’m not suggesting automation and orchestration are bad. You should absolutely use them. You should also make sure they don’t make you weak.
If you landed in a job today where you don’t really understand fundamentals, take some time to fix that. You’ll never regret it. /FIN
• • •
Missing some Tweet in this thread? You can try to
force a refresh
For laypeople demanding evidence that Russia is responsible for the #SolarWinds breach (and subsequent operations), be patient, it will come.
As an analogue, prosecutors typically don’t discuss specifics of ongoing investigations. This is because the target may interfere. 1/
This analogy unfortunately breaks down precipitously. First, this is less like a robbery than a set of ongoing hostage situations. The problem is that we don’t know how many hostage situations we have yet. Every piece of evidence we discuss publicly can hurt us. 2/
With the release of every indicator of compromise, we always must balance the value of helping victims with the risk that the attacker will change their tradecraft to prevent future detection.
This adversary has shown that they practice counterintelligence and WILL change. 3/
Moving beyond the technical aspects of the #SolarWinds breach, I think it’s clear that @FireEye dealt Russia a major blow by detecting this.
It’s hard to overstate the value of intelligence on government agencies, especially during an administration change. 1/
But this administration change is particularly important for Russia. There’s no question that the Biden administration will be more stern in its approach to Russia and knowing what’s being discussed/what’s coming was paramount for them. This intel loss cannot be overstated. 2/
So as you’re slogging through this week putting out the myriad dumpster fires surrounding this event, know that Komrade Boris is having to explain to Daddy Putin that they’ve lost a critical source at the time they needed it most.
For those not familiar with it, SolarWinds is a network management system (NMS). It’s probably the most ubiquitous NMS out there, so we shouldn’t jump to conclusions that FireEye and Treasury were both breached by an SolarWinds vuln. 1/
That would be an illusory correlation. If you’re jumping to that conclusion (or that FireEye and Treasury use a common MSP), at least be clear that you’re guessing.
It’s a lot like the DC Sniper case where we focused on white vans. SolarWinds (like white vans) is everywhere 2/
NMS are excellent targets. They have access to most (often all) systems on the network, so outbound IP ACLs are not a useful control. Netflow usually doesn’t help either since the NMS not only has access to everything, but it’s also talking A LOT. 3/
Buckle up folks, if you're looking for a fantastic example of the need for sound vulnerability management programs, read on (this is about more than Drupal):
The day before Thanksgiving, Drupal released a patch for a critical vulnerability for which exploit code is available. 1/n
Oh, BTW this is a serialization vulnerability. This is bad. It allows for a local file overwrite. In most cases, this means it will result in an RCE.
Did your team notice the vulnerability notification on Wednesday? The day before Thanksgiving? 2/n
I hear the choirs of "we don't use Drupal because CMS are all vulnerable" but that's dumb. Your corp website probably uses a CMS of some variety. "Custom developed" means that nobody else is looking at the code. In most cases, this is security through obscurity. 3/n
After further reflection I think Twitter has made a mistake censoring the NY Post article. It's garbage journalism, but that's not why they censored it.
Twitter is claiming that it contains hacked content and linking to it violates its policies. 1/n
First, let's note that Twitter has consistently penalized accounts for linking to hacked content. Their actions are at least consistent when viewed at face value.
The question for me then is this: does this constitute "hacked content?" I really don't think it does. 2/
If you take the story at face value, this is data recovered from abandoned property. Imagine you see a computer in a public trash can. You take it and extract data from the drive. Is that hacked data? More importantly, would Twitter censor a story with that data? 3/
This is also several degrees of bad. It's not "swastika might mean something else" (what???) when you are putting someone wearing a Jewish symbol in an oven. I don't think this has any place on the platform, but that's up to the platform and advertisers who support it. 2/
On the broader question of censorship, content platforms have a choice for what they wish to allow.
But they have a responsibility to not push offensive and radicalizing content to those who don't ask to see it. Driving dangerous content because people engage is unacceptable. 3/