https://doublepulsar.com/the-hard-truth-about-ransomware-we-...
> The truth is, while governments are pushing frameworks such as Zero Trust, the amount of orgs who successfully implement these are… not many. Many companies can barely afford to patch SharePoint, let alone patch the the tens of thousands of application vulnerabilities shown in a vulnerability management program, and really struggle with accurate asset lists. … > My concern, for years, has been that ransomware gangs have not only closed the loop on monetization, they are also acquiring so much income they are becoming a bigger operational threat than some states. > > To give an example, one ransomware group receiving a $40m payment for attacking a cybersecurity insurance company gives the attackers more budget to launch cyberattack than most medium to large organizations have to defend against attacks in total. And that’s just one attack, from one group, that barely made the news radar of most people. > > The payment amounts are increasing, the frequency is increasing, the sophistication is increasing.
https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch...
We have thousands of pages of frameworks and NIST guides and the people in charge, especially in the private sector, are free to neglect or ignore them with impunity because apparently regulators don’t care and the market doesn’t care, so why should they?
It’s like we have these brilliant cryptographers working on technical advancements that I can barely grasp, and the people (management) in charge of putting their work to use can’t be bothered with basic patch management.
The whole landscape of practical cybersecurity feels very hopeless to me.
For example,
>On top of rotating passwords on a yearly basis
> rotating passwords for users every 90 days
NIST 800-63B, as of 2017, explicitly advised against this.
"Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)." [1]
I'm a security pro and I rejoice in secure systems, but swinging the pendulum to the other side is bad too.
“Why do you wanna make that change? It’s expensive!”
“Because it says so right here, sir”
That “official” guidance can go a long way.
However, in my opinion one major failing of this paradigm is that while some additional layers are useful, it's still good to think about threat models and failure modes since at some point, you can't implement additional security measures due to the computational and human cost.
https://news.ycombinator.com/item?id=28050750
https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR...
> Agency continuously validates identity, not just when access is initially granted.
How does this work practically without having terrible UX? MFA to login, then periodically poll for the presence of a hardware token and less frequently, prompt for password reauthentication?
