More cloud woes

Fire the assistant who didn't know how to check whether the message origin was red flagged a database like this one.

Trying to educate people to do any of the above is, of course, a waste of time.

The Internet was designed for a benevolent exchange of information and communication. So, dealing with hostile actors is a bolt-on ("bag") approach to the problem.

I let someone who has skill and staff handle my email. I see *no* spam. And, the only "suspicious" messages we've received have been the result of friends being hacked (and their address books exposed; delete the email account that was exposed and give the hacked friend access to another account that is equally easy to track usage (and delete, if required).

This is the problem. In a world where people can't sort out how to set the time on a VCR, trying to explain anything more involved than "right for gas, left for brake" is a fool's errand.

And, people keep designing products and protocols with the same flawed concepts, rationalizing that "no one would hack a pace maker..."

only if you are naive enough to think you or someone else with access can't be tricked and that you are better at security than those who spend 24/7 fighting hackers

Don Y snipped-for-privacy@foo.invalid wrote: |----------------------------------------------------------------------------------| |"> Trying to educate people to do any of the above is, of course, a waste of time.| |This is the problem. In a world where people can't sort out how | |to set the time on a VCR, trying to explain anything more involved | |than "right for gas, left for brake" is a fool's errand. | | | |And, people keep designing products and protocols with the same" | |----------------------------------------------------------------------------------|

Deliberate persistent undeperformers insist on using Cloudflare despite Cloudflare messing up on them. So I complained to them but they use the lame excuse that Cloudflare affected many clients so they pretend that they are not at faults for choosing faulty Cloudflare! Cf.

|-------------------------------------------------------------------------| |"flawed concepts, rationalizing that "no one would hack a pace maker...""| |-------------------------------------------------------------------------|

Alastair McKinstry and John Murphy interviewed me for a job (completely unrelated to the pacemakers) in 2005. Alastair McKinstry asked me about a way to design software. I said that I was sorry that I did not know what he attempted to get at via this question. He elaborated - inter alia - that he heard that pacemakers frequently crash (and reboot rapidly to a recoverable good state). I said that he shocked me via the revelation that pacemakers crash. He said that he also became shocked when an embedded worker informed him so. (S.

If there is no route outside of your building from the resource (i.e., no route *into* the building to access it), then your security is likely 10 fold better than someone who has to defend such a pathway to YOUR resources.

Virtually everything is hackable so rationalizing that there would be "no interest" in hacking YOUR device is just silly talk.

Let me infect YOUR device with a bot, INSIDE your customer's firewalled network and have it talk to me for CnC outside the network. Now I can poke around AS IF I was inside your customer's facility as he likely trusts every box on his internal network.

Let some guy i n to service your printer, photocopier, etc. and are you sure he hasn't left anything behind?

Are you sure EVERY device on your network takes security seriously? Does your IDS notice outbound connections from unexpected devices? Are you sure none of those devices can *spoof* a legitimate device on the network by eavesdropping on traffic? Wired *and* wireless??

Of course, if one of your "legitimate devices" can be hacked, then the "plug" looks like a device that you've already accepted into your organization: "Move along; nothing to see here"

Designers are just SO naive about what they "expect" in their universes.

However, if everything you own is in one site - instead of being replicated at other sites - then you are vulnerable. E.g. an uncle's home recently was on fire (because an installer insisted on delaying installing a new boiler so an old boiler exploded, thereby destroying his new (waiting-to-become-installed) boiler and much else). Bad :( (S.

There are other ways of replicating things besides "the cloud". I keep warm backups "on site", a cold backup in the safe deposit box and cold backups with my colleagues (who are sharing my codebase). The latter is an expedient in case I drop dead -- they've got everything "on hand" instead of waiting for my estate to deliver the most recent changes to them.

E.g. an uncle's

Magnetic domains (or trapped pockets of charge) are relatively easy (and inexpensive) to duplicate. The bigger problem is hardware; what do you do when your workstation dies? Or, your RAID hardware s**ts the bed (assuming the media are intact)?

Are you sure you can rebuild your RAID array/ZFS pool if the ox that is hosting it needs to be replaced?

I've been discarding NAS/SAN appliances to ensure that I can move a drive to *any* machine and access its contents without wondering about whether a second failure will eat my lunch while rebuilding an array, etc. And, at the same time, limiting the size of my spindles to reduce the time required to copy them -- 1T at 200MB/s is 80 minutes; 4T is ~5 hrs; 8T is ~10Hrs. Split a spindle and you can have *two* (or 4 or 8) working at the same time to halve the window of vulnerability.

Large high profile targets are prone to very sophisticated phishing attacks that can seem plausible to junior staff. Improvements in technical defences have made deep phishing a lot more prevalent.

As one expert I knew put it "It is a very brave security officer that refuses to give the CEO his own password".

A bit like wearing a red security officer shirt and beaming down to the planet on series one StarTrek - life expectancy in the post is short.

Today AI's can walk through "My word is my password" bank security. (and yet some banks are still using it - adding 2FA helps a bit)

Attacks against wetware have become ever more sophisticated, well researched and the tendency of new starters or juniors to want to please their remote senior managers can be so easily exploited.

And, too often, people "want to be helpful" -- instead of cynical/critical.

And modern speech synthesizers can do a lot more with a smaller speech sample than technologies of old in mimicking a speaker! I don't rely on biometrics as authenticators as they are (or will soon be) too easy to spoof -- and the legitimate user has no way of invalidating THEIR biometrics!

Social media -- combined with the dark web -- allows an attacker additional insights into his "target". Does your phone utter an OGM in your own voice? Does your social media history shed light on your time at/away-from the office? Have you diligently labeled the folks in your shared photos (something that FB was encouraging users to do, years ago).

It takes some effort to "guard access". E.g., I use different email addresses for almost each entity with whom I correspond -- so I don't expect contacts from those entities on the "wrong" address (and, have some indication of how a particular address may have "leaked"). We are diligent about using "one time" email addresses for contacts that we don't expect to be persistent (addresses are relatively easy to create and destroy -- especially as hey need not have any specific significance: snipped-for-privacy@domain.TLD is just as appropriate as snipped-for-privacy@my.domain)

"Official" postal mail is received at a different address than our residence so we know anything that tries to LOOK to be official arriving at the house is likely to be a scam (not always true but often safer to assume anything coming to the house is just "junque" and drop it in the trash before it gets into the house)

We don't answer incoming phone calls so we aren't pressured into making "snap decisions" from perceived threats ("act now..."). We verify phone numbers left for us in messages instead of relying on them for convenience ("Gee, why does the number on my bank statement differ from the number left *by* 'my bank' in that phone call?")

Only if you value the integrity of your data. ;-)