Russian Hackers Hack Multiple U.S. Government Entities

[revenge_of_shocka_khan]

So I wanted to leave a short update....two things. One is that FireEye showed evidence that the patch that caused all the problems was digitally signed, so Kung's point was right.

However.....

There seems to be a suspicion of a lack of hygiene in the Solar Winds patch development process, security experts are stating there may have been some control gaps that would allow a developer (or a state-sponsored entity) the opportunity to install a payload at a point past the testing libraries where no developer should have access. If it comes out that this was a 'cut-corner' due to leveraging continuous development/deployment cycles (i.e. Agile), this is going to be a real black eye for them.

Note, I know of a very large firm that hired an executive to bring continuous release into their organization who stated that they would no longer require controls over change and release because they were now an agile shop and the process did not require controls anymore (they thought the process would govern itself). That person was handed their walking papers when unavailability numbers spiked due to a lack of rigor around the change and release process (flawed changes being introduced into production and breaking production).

I wonder if that person is in charge of change and release for solar winds (/sarcasm off).

I always like to say that Auditors are like cockroaches. We will be here in another thousand years because of executives that think like this.

[wufan]

So I wanted to leave a short update....two things. One is that FireEye showed evidence that the patch that caused all the problems was digitally signed, so Kung's point was right.

However.....

There seems to be a suspicion of a lack of hygiene in the Solar Winds patch development process, security experts are stating there may have been some control gaps that would allow a developer (or a state-sponsored entity) the opportunity to install a payload at a point past the testing libraries where no developer should have access. If it comes out that this was a 'cut-corner' due to leveraging continuous development/deployment cycles (i.e. Agile), this is going to be a real black eye for them.

Note, I know of a very large firm that hired an executive to bring continuous release into their organization who stated that they would no longer require controls over change and release because they were now an agile shop and the process did not require controls anymore (they thought the process would govern itself). That person was handed their walking papers when unavailability numbers spiked due to a lack of rigor around the change and release process (flawed changes being introduced into production and breaking production).

I wonder if that person is in charge of change and release for solar winds (/sarcasm off).

I always like to say that Auditors are like cockroaches. We will be here in another thousand years because of executives that think like this.

Why do you always attach irrelevant antidotes to your wrong theories? Is it a red herring?

[MikeKennedyRulZ]

Tin foil hat con at it again...

[revenge_of_shocka_khan]

Why do you always attach irrelevant antidotes to your wrong theories? Is it a red herring?

No, it's a blue one. I'd tell you to keep an eye on this, but you probably would need someone like KungWu to read it to you to understand it.

[wufan]

No, it's a blue one. I'd tell you to keep an eye on this, but you probably would need someone like KungWu to read it to you to understand it.

This is true! I am out of my element when it comes to tech infrastructure.

I will tell you this though, we had a family friend doing business in modern Mesopotamia with this Saudi prince back in 09. He was working on some top secret infrastructure deal with France, anyway, he enlisted the help of some Somalia pirates acting as a front to an NGO, and they were able to scam Alphabet out of 100s of dollars.

Anyways, this stuff is going on everywhere and I am adjacent to important people you don’t know.

[revenge_of_shocka_khan]

https://www.bankinfosecurity.com/microsoft-warned-crowdstrike-possible-hacking-attempt-a-15665

Orange man kisses Putin's a$$. Orange man will soon be gone. Good-bye orange man, don't let the door hit you in your backside.....