The feeling of getting hacked
Aug 22nd, 2008 by Jesper Kråkhede
Today I had an interesting experience too many have had before me. When I opened my mailbox I had a rather rude mail stating that my web hotel had been hacked. It seemed that I was luckily enough to not have been affected but still as I am not aware of the disaster recovery routines of my web hotel all passwords has to be changed.
This shows one interesting fact when we look at security architecture that I have mentioned before: Trusted computing base. Often you define TCB as the services you trust and do not trust. What is seldom done is handling the explicit and implicit trust that exists. You could for example trust your accounting system to be secure as it is often patched, exists on a safe subnet and are only allowed to be accessed by trusted systems. Still you could miss the application doing the backups that has an auto update function that recently was found to be insecure. Boom! There you go, an open way for a hacker to enter your systems.
So when working with TCB, take all details in account no matter how small. Sometimes it could be like rolling a stone up a hill, but in the end of the day, the stone stays on top of the hill, not on top of you.