Another runc container breakout
Another runc container breakout
Posted Feb 12, 2024 18:49 UTC (Mon) by raven667 (subscriber, #5198)In reply to: Another runc container breakout by Cyberax
Parent article: Another runc container breakout
I would add that while this may sound expensive, if you have more than a very small workload, partitioning the VM clusters by security level doesn't really cost much more in hardware, it's the same amount of resources you would have needed to provision anyway, as long as you don't get crazy about defining fine-grained boundaries at the VM level and constrain yourself to broad security risk zones based on the sensitivity of data being processed or the auditability/control of the devices connecting to it.
Posted Feb 12, 2024 20:30 UTC (Mon)
by rgmoore (✭ supporter ✭, #75)
[Link] (2 responses)
A lot of this stuff sounds expensive only because we tend to underestimate the cost of a security breach. If you properly account for that cost, making the system more secure by design starts to look more sensible. Until you get to the extreme, security is generally cheaper than insecurity. It's just the cost of insecurity is sporadic, so bad managers pretend it doesn't exist.
Posted Feb 13, 2024 4:51 UTC (Tue)
by marcH (subscriber, #57642)
[Link] (1 responses)
Same as planes crashing or plane doors blowing off and quality in general. It's very rare so surely you can cut corners here and there and save a fair amount of money.
I don't agree that "a security bug is just another bug" in general but from that pure cost and management perspective a security bug is indeed just a quality defect like any other.
That's why managers are paid so much: because _in theory_ they're able to find the best quality trade-offs - and it's hard. In practice however...
Posted Feb 13, 2024 11:31 UTC (Tue)
by Wol (subscriber, #4433)
[Link]
It also assumes the necessary data exists. My employer collects all the data imaginable, but as far as I can tell, the data I need to do my job doesn't exist ... namely "what are the discrepancies between what we've planned, and the resources we've got on the ground".
HOPEFULLY I'm going to succeed in doing something about it, but one lone voice crying "help" while drowning in a data lake can't achieve much...
Cheers,
Another runc container breakout
Another runc container breakout
Another runc container breakout
Wol