If you believe credentials like "CISSP" are "impressive" then you aren't qualified to write op-eds about cybersecurity. 
There's no such thing as "best practices". Pick any 10 "credentialed" cybersecurity expert for their list of Top 10 Best Practices, and you'll get 13 lists with very little overlap.
If it works for the medical industry with doctors (I'm sure they are fired when their patients die, right?) then it ought to work for cybersecurity.
The thing about words like "holistic" is that they allow anybody, no matter how ignorant of the subject matter, to sound intelligent.
"We can easily solve this Israel-Palestine conflict if only we tool a holistic approach to the problem".
"We can easily solve this Israel-Palestine conflict if only we tool a holistic approach to the problem".
Uh, the things ransomware exploits are the practices that were in place before ransomware. It wasn't new cybersecurity practices that enabled ransomware, but ransomware using new technique to monetize traditional hacking techniques.
We need new practices to combat ransomware.
We need new practices to combat ransomware.
Lol, what?
That's already what's causing ransomware -- far too many people have administrative control over things, allowing ransomware to quickly spread to the entire network. Developers have long been a problem in this regard.
That's already what's causing ransomware -- far too many people have administrative control over things, allowing ransomware to quickly spread to the entire network. Developers have long been a problem in this regard.
Cybersecurity will only undergo a renaissance if everybody stops doing what they are doing now and listen to my vague platitudes.
So here's what we need: fewer platitudes and generalities and more specifics.
For example: separate administrative access to the backup server so that when hackers gain domain admin they can't erase backups.
For example: separate administrative access to the backup server so that when hackers gain domain admin they can't erase backups.
I'm pretty sure 75% of my specific recommendations are wrong, either because they fail to adequately protect against the problem are because they are unworkable in practice.
But our discussion needs to be centered in specifics.
But our discussion needs to be centered in specifics.
I've analyzed a bunch of ransomware attacks, but my view is far from comprehensive.
Yet in all that I've looked at, the hackers got domain admin and then access to anything that was a live backup (e.g. shadow copies).
Yet in all that I've looked at, the hackers got domain admin and then access to anything that was a live backup (e.g. shadow copies).
What I mean to say is, I'm not calling the author an idiot because his advice is bad. Most of my advice will also be bad.
Instead, I'm calling his advice pointless. Words like 'holistic' are platitudes with no specific meaning to see if you've achieved them or not.
Instead, I'm calling his advice pointless. Words like 'holistic' are platitudes with no specific meaning to see if you've achieved them or not.
This tweet has an even better rebuttal:
https://twitter.com/SimonLevermann/status/1394760584151945216
• • •
Missing some Tweet in this thread? You can try to
force a refresh
