Facebook Security Chief Says Its Corporate Network Is Run 'Like a College Campus' (zdnet.com) 85
An anonymous reader quotes a report from ZDNet: Facebook's security chief has told employees that the social media giant needs to improve its internal security practices to be more akin to a defense contractor, according to a leaked recording obtained by ZDNet. Alex Stamos made the comments to employees at a late-July internal meeting where he argued that the company had not done enough to respond to the growing threats that the company faces, citing both technical challenges and cultural issues at the company. "The threats that we are facing have increased significantly and the quality of the adversaries that we are facing," he said. "Both technically and from a cultural perspective I don't feel like we have caught up with our responsibility. The way that I explain to [management] is that we have the threat profile of a Northrop Grumman or a Raytheon or another defense contractor, but we run our corporate network, for example, like a college campus, almost," he said.
Hacked (Score:5, Interesting)
Well, considering their 1.2 billion people DB hasn't leaked .. I guess they're doing OK job, compared to let's say yahoo... who have been hacked like 3 times in 5 years ? Or linkedin. Or equifax.. or ..
Re: (Score:2)
Re:Hacked (Score:5, Interesting)
Well, if you run your network like a college campus, you probably wouldn't know if you're being hacked.
So ... let's put it that way, when you're blind, you can't see the elephant standing in front of you as long as he doesn't step on your foot.
Re:Hacked (Score:4, Interesting)
OR, if you're running a college campus network, you assume it's the worst combination of raw internet and bored / mischievous students; so the network itself you treat as untrustworthy and build better systems on top. You assume constant hacking so you build systems tough rather than complacently relying on 'defense contractor firewalls'.
Let's hope that's what's happening.
Re: (Score:2, Insightful)
Yeah, when I read the headline, I thought they were explaining that running it like a college campus is the *right* way to do it. It pretty much is. I'd be more concerned that their chief of security doesn't understand how colleges are successful at running such open networks.
Re:Hacked (Score:4, Interesting)
Pretty much... I've had to evaluate security solutions hailing from the corporate sector for application in .edu, and I have to say so many of them put a disturbing amount of trust on their abilty to lock down the client OSes. Now this makes them pretty much useless in an environment where joining the majority of devices on the network to a domain or MDM is just plainly not an option (the users won't stand for it and even if they did, we have continuing ed users with conflicting configs on the work laptops from other companies which they bring to class). But even if we were able to do so, you should pretty much never trust client machines, even if you've gone all in on the even-with-TPM-won't-even-boot-BIOS-unless-connected-to-a-cloud-verification-service crap. You have to harden the infrastructure as if it were an internet-facing service, (while still doing what you can on the network layer to restrict access and at the OS layer to keep machines updated.)
Re: (Score:1)
It depends on the college campus. I have witnessed places that are mind-blowing in their insecurity. They would have been considered insecure in the 1990s yet still operate today.
The worst included a single VLAN spanning an entire building and including machine rooms, staff offices, student offices, labs, and conference rooms. Every computer in this network has a public IPv4 address and no firewalled ports except what they enforce locally in the computer. They even have some cargo-culted, DMZ-like subnet w
Re: (Score:3)
Who hasn't taped over the cam on his laptop?
Re: (Score:2)
Who hasn't taped over the cam on his laptop?
That's the only way I can get wimmin to join me on Chatrbate! Otherwise, I scare them.........
Re: (Score:3)
Well, if you run your network like a college campus, you probably wouldn't know if you're being hacked.
So ... let's put it that way, when you're blind, you can't see the elephant standing in front of you as long as he doesn't step on your foot.
I'd be a little worried though if I was a present employee. The cultural differences between the two areas, college campus and defense contractor are pretty extreme. And it may be presumed that they have people of the college campus mindset at present. So when do they start lining up the employees for the polygraph tests?
Re: (Score:1)
If I were blind I still wouldn't see the elephant if it steps on my foot. That would be a miracle!
Re: (Score:2)
Believe me, when an elephant steps on your foot, you won't care whether or what you see.
Re: Hacked (Score:3, Funny)
I visited their so called "campus". It is fucking filth, with kiddies running around I thought it was a kindergarten. Who the fuck in their mind is trusting zuckerburger with security.
Re: (Score:3, Insightful)
Well, I wouldn't be surprised if some college campuses have better security than some defense contractors.
Especially if said campuses teach computer security, and there are hundreds of wannabe hacker students inside it and renowned security researchers in their ranks.
One example (Score:4, Informative)
Well, I wouldn't be surprised if some college campuses have better security than some defense contractors.
I cannot speak for every defense contractor but I've worked at one in the past and with a few as a vendor and I can assure you that their security (physical and IT) was CONSIDERABLY tighter than any college campus I've ever seen, at least where I was working.
Re:One example (Score:4, Interesting)
And I've worked with defense contractors with abysmal security... They had safes, paper shredders, badges, special networks, all that stuff but it was just a facade. People shared passwords and used personal USB keys to transfer data, it took so long getting physical access that tailgating was the norm, airgaps weren't, outdated software, the IT department was so incompetent that bypassing it was almost a requirement for getting things done. While working there, I stumbled upon several gross vulnerabilities without even trying.
At school, students had much more freedom but at least the network was sane, and the IT department was not the friendliest place on earth but they did the job.
Sloppy? (Score:4, Insightful)
Well, considering their 1.2 billion people DB hasn't leaked ..
If it's run that sloppy then it might have already happened and they/we just don't know it yet. My suspicion is that it is merely a matter of time before Facebook has some form of catastrophic data breach.
Honestly I'm not even a tiny bit surprised that Facebook is sloppy. They have a looooong pattern of not giving a shit about the people who use their service and being alarmingly relaxed (for lack of a better word) with privacy and the rights of their users. This is just another example of why I don't trust Facebook and do not have an account with them.
I guess they're doing OK job, compared to let's say yahoo... who have been hacked like 3 times in 5 years ? Or linkedin. Or equifax.. or ..
Talk about damning with faint praise...
Re:Sloppy? (Score:4, Insightful)
This is just another example of why I don't trust Facebook and do not have an account with them.
You never signed up for an account with them. That doesn't mean that there isn't a nice fat DB entry with your name and all the information they can gather. Did you sign up for Equifax?
Re: (Score:2)
This is just another example of why I don't trust Facebook and do not have an account with them.
You never signed up for an account with them. That doesn't mean that there isn't a nice fat DB entry with your name and all the information they can gather. Did you sign up for Equifax?
Install noscript and look at the scripts it's blocking. Look, em up to see who's collecting the data. Facebook is tracking you even if you've never had an account there.
Minimizing harm (Score:2)
You never signed up for an account with them. That doesn't mean that there isn't a nice fat DB entry with your name and all the information they can gather. Did you sign up for Equifax?
Oh I'm well aware they are trying to gather data on everyone. I also cannot stop my idiot friends and family from posting information and pictures about me. Nevertheless I'm not going to cooperate with them and I make pretty heavy use of software to block advertisers and others who want to track my actions on the net. I'm sure information leaks through but they don't have nearly as much on me as they could if I took no measures and they don't have information voluntarily from me.
Re: (Score:2)
"Well, considering their 1.2 billion people DB hasn't leaked .."
Leaked? You just have to download the whole thing, you get everything.
Re: (Score:2)
Re: (Score:2)
Well, considering their 1.2 billion people DB hasn't leaked .. that we know about.
FTFY :)
Re: Hacked (Score:2)
I would so love to be able to be freely able to query their database.
Re: (Score:2)
Jason just called. He wants to know if you're his daddy.
Re: (Score:3)
Mostly 'cause they want to sell that data. If it could be taken freely, who'd throw money at them?
They're just protecting their assets.
Re:Good on them! (Score:4, Interesting)
That is true, however it's not the point of this story.
It was also true for Equifax, wasn't it, and still they were breached due to negligence.
This is more a matter of one company trying to do the minimum while others will happily gnaw at their last leg or sit there watching contentedly while their house is being washed down the river brick by brick.
The only tragedy is that doing what you're supposed to do has become such a seldom event for corporations that it's news-worthy. If it was due to actual ethics, it would be the proverbial unicorn.
Re: (Score:2)
They were breached due to incompetence. Whoever didn't keep all web front end up to date made a mistake, that's not negligence ... mistakes get made. Security should mitigate mistakes.
Whoever allowed a bug in a fucking web front end to escalate into their entire database getting downloaded, now he has something to answer for. Of course almost every IT department gets their entire shit owned by their web front end being exploited ... almost the entire IT industry is incompetent.
Re: I know facebook's security team (Score:2)
Except it's their data, not mine. Even tho it's about me. This problem needs a legal, not technical, solution.
That's not going to help. . . (Score:4, Interesting)
. . . this effort:
Facebook Is Looking for Employees With National Security Clearances [bloomberg.com]
Wait till Milo stops by... (Score:2)
Fires and employee uprisings and the members of the board running around going "NAZI!" and punching random people...
College Campus? (Score:5, Interesting)
Re: (Score:1)
Speaking as a developer who has worked with defense contractors, I can tell you that they take checking off government checklists of what qualifies as "secure" very seriously, but that's about it. As long as they can say "we followed the checklist!" and point fingers back at the government, they don't care even a little about true security.
Re: College Campus? (Score:2)
I *wish* my company could afford military level security. They may sometimes be checklist checkers, but at least they take the matter seriously.
Colleges are locking networks down hard (Score:1)
A college campus network in the late 90s was as close to "free flow of information" as you can get. Nowadays there are firewalls everywhere. The last university network I was on didn't even allow NTP syncs with external servers.
Re: (Score:1)
You are not kidding. I currently work for a pretty large university and every dorm room's switch port is on a solo VLAN with the uplink port, so no two ports can talk to each other. Even more, every port is only allowed one MAC address, which a user must pre-register with IT. In other words, students cannot have two computers talking to each other at all, unless they buy their own switch and do it locally (which is against the AUP of the university, even if their private LAN is airgapped). That means studen
Re: Colleges are locking networks down hard (Score:2)
I'm torn between "behind the curve as always" and "one law for the little people, a different law for the big people".
Re: (Score:2)
One MAC address per port is a bit on the extreme side for a residential user hospitality port... probably they have just not yet bought equipment capable of multi-client wired MAB/dot1x thus the one-MAC-address limitation. Registration of your MAC addresses is absolutely essential for security as, with wired dot1x and a cert bearing your registration, you can shut down a huge number of amateur-skill attacks by doing that (and if you haven't gotten all the way to wired dot1x yet and are still using MAB, you
Re: (Score:2)
Honest question. Since MAC spoofing is apparently easy (https://en.wikipedia.org/wiki/MAC_spoofing), why is registration of your MAC addresses "absolutely essential for security"?
Re: (Score:2)
Well, most places haven't gotten to quite this level yet, when combined with a EAPOL EAP-TLS/dot1x you register your MAC address, you get a client cert containing that MAC address, and the switch will not let you on using a different MAC address than one you have registered. Presumably you don't allow double-registrations, of course. (Further past that you can close the last of the wired MITM vectors with MACSec but that requires rather new switches still.)
But even with (yes, easily spoofable) MAC address
Re: (Score:2)
But isn't that mostly security through obscurity?
Re: (Score:2)
students cannot have two computers talking to each other at all, unless they buy their own switch and do it locally.
You mean unless they run a NAT gateway and communicate which high numbered port to use for their service.
Re: (Score:2)
Re: You can't be hacked (Score:2)
True.
In a sense, publicity is the ultimate security.
Former security Chief (Score:2)
If he wasn't "former" at the disclosure, he surely will be shortly after.
So, they will lock the network down to be useless? (Score:4, Interesting)
Wow! (Score:2)
Re: (Score:2)
"Move fast and break things" (Score:3)
The problem is that it's very difficult to resolve "move fast and break things" developers with anything approaching information security. If you run an extension of a college campus like Facebook does, you're going to get a college campus mentality.
I can see why they are concerned though...Facebook has become the de facto identity provider for almost every consumer website. That "sign in with Facebook" button lets developers assume that Facebook will keep login details for millions of users safe. Microsoft has this same problem with Office 365/Azure AD and they've gone to great pains to explain what they're doing around security. Any time you are providing a vital service that others are counting on, and you have people's personally identifiable information stored, you can't put that in a college campus environment.
Re: (Score:2)
FWIW, "move fast and break things" developers don't generally last very long in college environments. Software dev runs at a snails pace because everyone is actually using the software for important things, and when it breaks, there is hell to pay from the users... and the users are only a short walk away from you.
Does that mean (Score:2)
Employees are f-ing like monkeys, drinking like sailors, and staying up all night to try to finish that last bit of code which ultimately results in a D+ grade?
Manufactured outrage (Score:2)
Lots of people outraged that their network is run like a college campus, no one looking at what he meant by that phrase.
Someone wants a raise. (Score:1)
If what he claimed were true, FB would've had a major breech already. This sounds more like internal political jockeying rather than valid concerns.
drone riots (Score:2)
If you have sysops or security experience from uni (Score:1)
You have a great career in front of you. Employed a few myself. Great combo of open network experience with hardened systems with thousands of smart little shits ( technical term ) trying it on daily.