security policies – Noise https://noise.getoto.net The collective thoughts of the interwebz Wed, 09 Feb 2022 21:30:41 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.2 On the Irish Health Services Executive Hack https://noise.getoto.net/2022/02/11/on-the-irish-health-services-executive-hack/ Fri, 11 Feb 2022 12:17:53 +0000 https://www.schneier.com/?p=65035 A detailed report of the 2021 ransomware attack against Ireland’s Health Services Executive lists some really bad security practices:

The report notes that:

  • The HSE did not have a Chief Information Security Officer (CISO) or a “single responsible owner for cybersecurity at either senior executive or management level to provide leadership and direction.
  • It had no documented cyber incident response runbooks or IT recovery plans (apart from documented AD recovery plans) for recovering from a wide-scale ransomware event.
  • Under-resourced Information Security Managers were not performing their business as usual role (including a NIST-based cybersecurity review of systems) but were working on evaluating security controls for the COVID-19 vaccination system. Antivirus software triggered numerous alerts after detecting Cobalt Strike activity but these were not escalated. (The antivirus server was later encrypted in the attack). ...
]]> Security Risks of Client-Side Scanning https://noise.getoto.net/2021/10/15/security-risks-of-client-side-scanning/ Fri, 15 Oct 2021 14:30:10 +0000 https://www.schneier.com/?p=63769 Even before Apple made its announcement, law enforcement shifted their battle for backdoors to client-side scanning. The idea is that they wouldn’t touch the cryptography, but instead eavesdrop on communications and systems before encryption or after decryption. It’s not a cryptographic backdoor, but it’s still a backdoor — and brings with it all the insecurities of a backdoor.

I’m part of a group of cryptographers that has just published a paper discussing the security risks of such a system. (It’s substantially the same group that wrote a similar paper about ...

]]>