Posts by Matthew Poole
Last ←Newer Page 1 2 3 4 5 Older→ First
-
OnPoint: MSD's Leaky Servers, in reply to Neil Graham,
This notion that the Kiosks shouldn’t have been connected to the same network is what strikes me as odd. The property of connection should grant absolutely no advantage. It would be one of the easiest aspect to bypass.
Actually, no, it's about the hardest when done properly. If it was as easy as you believe, installations dealing in national security wouldn't be required to physically segment networks based on the classification of information stored and retrieved.
The GSCB's "bible" on securing electronic information might give you some more insight into the best of good practices when setting up computer systems. Keeping systems with different security profiles separate with a firewall between them is as vital as it gets, given the principle that "If you have the hardware, the hardware is insecure". 0wn the box to your heart's content, but if you can't reconfigure the firewall that keeps it apart from the rest of the network you're stuck in your little corner of the world. -
OnPoint: MSD's Leaky Servers, in reply to Neil Graham,
When assessing risk you look at likelihood and consequence. The consequences of someone breaching the security of the WINZ/MSD network are quite serious, so even if the likelihood is low you do more work to implement security than you would if it was, say, NZ Film Commission. If there's a physical separation of networks the utter compromise of one side does not equate to utter compromise of the other side. If the terminals were on their own network segment, isolated from the rest of MSD, they could be virus-ridden mirrors of the worst of the internet and MSD would be safe. Someone could break them from top to bottom and still have no access to MSD. Even if the kiosks had been joined to the MSD domain they attacker would still not have access to the rest of MSD because they would have no connection.
As Rich says, it's about defence in depth. Every layer that must be penetrated is another chance for detection, it's another hurdle that might cause the attacker to give up. It deters the casual busy-body, and with physical separation even if nothing else is done the casual busy-body can't get anywhere anyway.
Using wifi to bridge the gap? If someone has access to connect to wifi on the other side then the gap is irrelevant because they're already inside. They don't need to compromise one side and then leap over, they just start on the inside. Certainly MSD shouldn't be attaching access points to their internal network either, or having network ports in public spaces that are live and connected to the internal network such that someone could plug in their own access point and start sniffing.
-
OnPoint: MSD's Leaky Servers, in reply to merc,
We need to know how much Govt. has exposed us to liabilities for non-transparent spending decisions.
What makes this one so infuriating is that it could've been mitigated if the recommendations had been followed through. The cost to mitigate this risk properly might've run up to $100-ish-k if scaled out across all WINZ offices with the kiosks (assuming additional costs for physical segregation devices), but that's guesstimating at the very high end and compared to the costs of cleaning up properly after this debacle it's a complete bargain. Doing the damage control properly on this one is millions of dollars.
-
OnPoint: MSD's Leaky Servers, in reply to Russell Clarke,
It was uncovered a year ago by Dimension Data’s testers. That suggests the vulnerability has been there since day dot.
ETA: That’d be uncovered in April 2011, and the kiosks only went into testing late in 2010.
-
OnPoint: MSD's Leaky Servers, in reply to Sacha,
Well, your wish was granted :) I also got republished on itnews.com.au. Thanks for the initial push.
-
For the curious, I spent 10 minutes being interviewed on Nine to Noon this morning and also contributed to this piece on Morning Report.
It's been interesting becoming an "expert" overnight.
-
OnPoint: MSD's Leaky Servers, in reply to John Holley,
the security hole has been there for two years
FTFY
-
OnPoint: MSD's Leaky Servers, in reply to Russell Clarke,
Perhaps the business did indeed treat this as a low priority, but I would expect any savvy technology partner to be raising their hands and shouting about this to the governance stakeholders, and saying it’s not acceptable.
Saying ‘we were just following orders’ is a cop-out.
In the current political environment regarding privacy of client information, are you at all doubtful that this could've been ignored by those at the governance level? Particularly if the report from S-A was jargon-heavy and could be dismissed as "someone's got an over-active imagination. None of our clients are that smart."
-
OnPoint: MSD's Leaky Servers, in reply to merc,
Their basic duty of care
aha. haha. hahahahahahahahaha.
-
And this, which is even more explicit that the testers found things and reported them, and there was a failure to follow through on what was reported.