Slashdot Mirror
NVIDIA Breached
jones_supa writes: Another day, another corporate network intrusion. NVIDIA has reportedly been breached in the first week of December, with the attack compromising personal information of the employees. There is no indication that other data has been compromised. This is according to an email sent out by the company's privacy office and Nvidia's SVP and CIO Bob Worwall on December 17th. It took NVIDIA a couple of weeks to pick up all the pieces and assess the incident. It appears that the issue was pinned down by an employee or several employees getting their personal data compromised outside of the company network. After that, the information was used to gain unauthorized access to the internal corporate network. NVIDIA's IT team has taken extensive measures since then to enhance the security of the network against similar attacks in the future.
I wonder what that means, exactly.
My hopes are that it means ensuring anyone on the outside is coming in via 2FA, internal and DMZ networks have a proper IDS/IPS in place that is tailored to the division in question (i.e. a bunch of point of sale terminals would sound an alarm if one of them decides to start making random connections to a site in Elbonia), there is an internal detection process so someone trying to brute force an account will make an audit trail and get a curious admin looking at why the events are happening.
My hopes also include isolation of DMZ boxes so that unless they are intended to communicate with each other, they can't. Isolation between departments would be nice as well.
Finally, my hopes include having remote access being more of using Citrix or RDP and having the remote machine be more of a dumb terminal, as opposed to an active VPN, making the remote machine a part of the corporate network.
Of course, my fear is that "extensive measures" will be a domain admin logging on, popping up a command shell, typing in:
dsquery user | dsmod user -mustchpwd yes
and calling it a wrap.
I'm hoping nVidia does more of the "hopes" portion.
And yet at my company I can't get the GM and president to let me implement a basic computer and security competency test for all new hires that use computers. I'm CIO by the way.
Perhaps there will be some 'unexpected improvements' in open-source drivers for nVidia chipsets in the near future...
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
The #1 question on everyone's mind is, does the data leaked indicate that mangement at Nvidia also admits that the shield is a pointless, overpriced device with no market? I'm reeeeally dying to know. They're like a tablet mixed with a PSP mixed with a steambox but worse than all 3. I can't imagine anyone there is too happy with it.
NVIDIA has reportedly been breached in the first week of December
Bit of a mixed up tense there. Makes it sound like time travellers did (are doing) it.
systemd is Roko's Basilisk.
Does anyone else find it ironic that every time one of these breaches happens... all the employee and costumer data walks right out the door. But their source code? Propitiatory corporate secrets? Oh, those are locked up tighter than a drum.
It's not hard to prevent these "hacks" or "Leaks" they just only chose to actually spend money to protect what's valuable to them. After their employees or Customers personal info is out there, they throw some money at a Credit monitoring service and pretend like that means anything at all? What did it cost them? $1 a user? LOL
We need federal liability laws. The feds do not need to dictate what they need to do to secure data like they've requested. They know, and we know that's a joke. The law will be out of date before it even takes effect. Simply make them liable for $100k per persons personal data they leak. They will quickly just flat out stop storing the data in the first place and we'll all be better off.
That's covered by basic permissioning, surely?
If the user you got access to has access to HR data, they have access to HR data. Anything else in the way is merely a hindrance (to you, and an intruder).
But if you compromised a server and used them to get administrator access on the storage arrays, pretty much it doesn't matter what you've got in-between.
The real solution, I think, would be proper encryption. But even there, you have the problem of key management that doesn't just hand out keys to the servers when they request them.
Fact is, yes, it might be sensible to cordon-off a few of these things. You already have to have PCI-DSS stuff on isolated networks (to simplify their requirements), but it doesn't seem to stop this stuff. I know schools that, for years, separated off curriculum and admin - i.e. it was impossible for a child to compromise the deputy-head's login in the classroom and use it to get access to personnel data). I still stick to that mentality and move things to be physically apart wherever possible but nowadays it's considered old-hat and all the separation is virtual - VLAN's and permissioning on the servers and storage arrays.
You put barriers in between but this kind of attack is more akin to the boy with his finger in the dyke. Your users (in HR, or Finance, or wherever) need that tiny hole to be open for them, and so piggybacking in on their connection automatically gives you access to this stuff.
The problem is that intrusion detection / prevention, really, is nothing more than checking EVERY transaction back and forth and that's a huge undertaking, slow, requires lots of equipment, and has to be constantly updated by people as threats appear. It's not an easy problem to solve. Even governments are having slips with their classified data, because even though the networks are supposed to be completely isolated, it only takes one guy (malicious or not) to be compromised for that barrier to have a gaping hole in it for him to do his job through.