This was via @sjmurdoch.
The whole blog is very good - lots of issues where the cause isn't some crazy crypto bug - it's someone assuming something
Prikaži ovu nit
In Infosec, we need to consider Confidentiality Integrity Availability We often forget Availability - keeping something available often runs contrary to security. Interesting story about how handling the encoding of years on EMV cards led to downtime: https://www.lightbluetouchpaper.org/2010/01/19/encoding-integers-in-the-emv-protocol/ …
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
it's a good reminder that some of the most vocal infosec people (here anyway) have *never* owned production Ops on systems that matter, because those who have rarely begin a design discussion with "Why don't you just…".
-
There are some very good follows on real-world engineering in Infosec.
@dinodaizovi is one that comes to mind, the Monzo engineering team as well. - Još 2 druga odgovora
Novi razgovor -
-
-
And funny enough a lot of security measures directly and negativity affect "availability". E.g. put stuff behind a firewall -> I can't access it any longer from home. 2FA -> additional step before I can use it ...
-
Yep! Finding a good balance.
Kraj razgovora
Novi razgovor -
-
-
Imho since Ryuk/Emotet Availability is much more understood by businesses
- Kraj razgovora
Novi razgovor -
-
-
The whole of the industry could benefit from remembering that security does not exist in a vacuum to perpetuate games of cops & robbers**... Security is present to help deliver a product /service. **unless of course you’re a cop or a robber
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
I came to security from working in environments with very high availability requirements. So a disregard for availability is one of my pet hates. It's about risk fundamentally; know your threats(malicious and accidental) and impacts.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
I’d argue that availability in its rawest form, leading to larger enterprise issues such as disaster recovery, service continuity and operational resilience are the most commonly overlooked and/or untested areas. Even mature organisations still fail to get this right.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.