You don´t have to protect against everything
Sep 17th, 2021 by Jesper Kråkhede
After my post on Rowhammer I got a worried mail from a manager. Should we be protecting against this?
My answer: Probably not. At least not before you have done everything else.
Rowhammer is fascinating, but it is hard to exploit in practice and there are very few, if any, known real world attacks using it. Meanwhile, the attackers who hit companies every day use stolen passwords, unpatched servers and admins logging on everywhere. They don´t need to flip bits in your memory. You are giving them the keys at the door.
This is one of the most important principles in security, and I have repeated it on this blog for years: Do the right things first. You don´t have to protect against everything. You have to protect against the easy things, because that is what most attackers use. Make the easy ways hard, and most attackers will go looking for an easier target.
So when someone brings you an exotic threat, ask three questions. Is it actually used against companies like ours? Have we already closed the easy ways in? And what would it cost compared to what we haven´t done yet?
If the easy ways are still open, spend the money there.
The advanced threats make the headlines. The easy ones make the incidents.