Comment

I like what you are doing, but I want to tell a little story for educational purposes:

Once there was an IT pro (like in “it’s their job to do stuff like that for money, but with a team and funds") who thought he’s smarter than the internet and started selfhosting on a VPS for the family. Nothing dramatic, just some nextcloud stuff and games for the kids. Everything was secure and always up-to-date, backups to multiple locations, the works.

This worked for years, but one night Mr. Smartypants made a tiny config change that needed to be reversed for full security. But he forgot about it. And it took only 3 hours for a bad actor to exfil all data and burn the VPS to the ground. And that was before AI started to roam the web…

You get the idea: you can do everything right, but then you will make that one tiny mistake or forget an update. With the internet at its actual state you can asume all your data will be compromised or gone at some point. Just make sure that’s ok for you.

source

Sort:hotnew top

elvith@feddit.org ⁨5⁩ ⁨days⁩ ago
If you put any data anywhere, assume it will be contained in a breach in the future. Blue teaming is hard. You have to be perfect every time. Red teaming is easy. You just have to wait till the blue team makes a simple mistake…

Mails sent to a company? Their or your mail account will be breached one day.

Account details on a webpage? Their user database will be leaked.

Your cloud drive, ect.

Even your data on your NAS at home or on your PC could get accessed in one way or another, you’re just a zero day and an unfortunate click away from disaster.

On the upside, as long as you do not have a target on your back, patch your stuff in a timely manner and keep some hygiene in configs, secops … You should be fine, as most automated attacks aren’t that high level and target the low hanging fruits. But that doesn’t make you completely safe.

source
- dentacle@bookwyr.me ⁨5⁩ ⁨days⁩ ago
  
  Blue teaming is hard.
  
  After 20 years in the field I’d say it’s an impossible job. We are always 5 steps behind. Now with AI, 27 steps. I quit IT to keep my sanity.
  
  And don’t listen to the promises of big companies with billion-funds, they cook with water like the rest of us. See " Amazon infiltrated by North-Korea “.
  
  source
  - elvith@feddit.org ⁨4⁩ ⁨days⁩ ago
    
    And don’t listen to the promises of big companies with billion-funds, they cook with water like the rest of us.
    
    Oh, yeah, I remember when one of our super important core systems was migrated to SaaS. My system was interfacing with it, so I got notified about the migration to make a plan. I basically told them: “We’re using $API to connect to your system. Tell me the new hostnames and IP ranges and ports and I will configure the firewall on our end. Also, our connector for your migrated system will be deployed in $IP-range so please allow these inbound connections in your firewall.”
    
    Half a year later I got a message: “Yeah, we just found out, that $SaaS-provider never configured the firewall after our tickets and everything is reachable from the public internet. We’re forcing them to lock down the system now. Can you please tell us again from where you connect to us?”
    
    source
  - d00phy@lemmy.world ⁨5⁩ ⁨days⁩ ago
    That N Korea story was wild!
    
    source
d00phy@lemmy.world ⁨5⁩ ⁨days⁩ ago
NGL, it’s scary! I still haven’t put anything of consequence on the VPS. Right now, I have everything on 1 system going through swag. I’ve long been a proponent of not fixing what isn’t broken, so I might look for a way to scale my current setup to more than the one system.

I host a couple of small services for more than just me, but I have no plans to provide any cloud services to anyone else but my wife (if she wants).

Thanks for the story, though. Sorry you went through that. I’ve been lucky so far. I’m hoping things stay that way, but obviously trying to plan for when they don’t!

source
- dentacle@bookwyr.me ⁨5⁩ ⁨days⁩ ago
  
  Sorry you went through that.
  Me? Who said that was me? I never said that. How rude. Nothing like that could ever happen to a brilliant guy like me. No, you shut up!
  
  I still haven’t put anything of consequence on the VPS
  Maybe keep it that way? It’s just not worth it in the end. If you just want to play with new tech on a VPS, have at it. But maybe without important data, and make sure to tell every user of your services about the risks. Because in the end, you are responsible. You are not Microsoft, a company that was never held accountable for billions in corporate damages through cyber-securitty bullshit.
  
  source