Is it on topic to ask about specific attack events?

Question

Is it considered on topic to ask about details about specific attack events or breaches?

For instance, several Swedish newspapers were recently the target of a major DDOS attack, and I would like to ask some questions about it, like what kind of DDOS and what size it was. Other examples would be questions asking about how specific high profile data breaches like Ashley Madison or Sony were done.

I realize that some of the time the answer might be that the information is not publicly known, but on the other hand it might be publicly known other times.

Answer 1

It should be OK to ask, because we learn from our mistakes and from those of others. But asking the question risks inviting speculation.

I don't think a representative from Ashley Madison will ever post the definitive answer because they're probably going to fight this in a courtroom for the next decade, where their lawyers would caution them against admitting anything that might indicate negligence on their part. So we may never know whether the answers provided are correct.

Answer 2

I'm responding to @ArtjomB's comment that if the answer to a question is not publicly known, then the answers will be primarily opinion-based by definition.

I see no problem with this here on InfoSec.SE. Nor any reason to close the question. On this site, "expert opinions" are ok and actually quite valuable to the community. An analysis of how an attack might have been executed helps our users (who are often system admins) to become aware of vulnerabilities, think like an attacker, and reduce their own attack surfaces.

Whenever we see a question like "How did high-profile breach X happen?" answerers often chose instead to focus on the implied question of "...and how do I protect myself from a similar fate?". I think there's tremendous value in that.

Answer 3

This would be the place to ask about it because it brings with it the implied questions of What attack vector was used? and What can we do to prevent this in the future? which most good answers will answer both of without making you realize they were implied in the first place.

In the case of a question like TOR cracked: How do you think the FBI did it? it was entirely opinion based since we don't really know and the implied questions can't be answered and there were no deeper questions to be answered like how do I protect myself on tor from the FBI? since there isn't an answer to that question that wouldn't be opinion based entirely and there is no way to protect yourself from it.

However the question Internet courtship: Why would a hacker buy me poker chips? is a great example of just this since it is an attack that is well known about, and even if the answer is of a little bit of speculation on to WHY or HOW it happened, the answer still provides the answer to the real question of what should I do now? and how do I protect myself from this in the future? since those questions have concrete answers to them. Really when people ask these sorts of question they are asking the implied questions that follow or a different, deeper question instead.

The question of Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited) is an example of something primarily opinion based(different context though) with a deeper real question to ask instead. While the company will always impose different sanctions on it's workers, really this question was How can I protect myself from Company IT gaining access to my personal information?.

So really the rule of thumb to asking these questions is(IMHO) Does an answer to this question make the world a safer place by letting people discover ways to mitigate these types of attacks on a grander scale?, but a better things to ask yourself when posting these questions is Where does this apply on a grander scale? and if you can ask the second question, it's usually the better question to post.