321–327 of 327 posts
Earlier quoted context omitted.
One could argue the security industry exists because of the failings of computer science. Maybe swes should start facing legal liability for thier failings like most other engineering disciplines. We would see this problem change overnight.
By productivity going completely down the drain.
Earlier quoted context omitted.
It shouldn't be buzzword soup, that does not mean that companies and vendors don't use it that way. Pretty much any time a new security concept comes up vendors race to say that they implement it, whether they do or not. With Zero trust, it's hardly a new idea (e.g the Jericho forum de-perimeterization) but it's hard to implement well across all systems.
If you're stupid enough to fall for vendor buzzword garbage that's kind of on you though, right? It says nothing about ZTN.
Earlier quoted context omitted.
> The answer there, clearly, is to not have an individual be a potential SPOF. If failure of that kind of support costs millions of dollars, you absolutely need to have the ‘walked in front of a bus’ scenarios worked out. I'm not going to post details in public, but suffice to say, you are over-simplistic and don't understand the context. Sticking with my example of dealers, let's just say people like dealers are not…
> Sticking with my example of dealers, let's just say people like dealers are not employed in great numbers in all but the largest financial organisation. Let's also say that there are certain events and certain times of day when the entire dealing desk is, shall we say, "busy and stressed out". There is little scope for a colleague to step in at those times, because everyone is franticly busy on the phones with thei…
- hire more dealers ($$$$$$$$$) - staff an IT group that is open 24/7 ($$$$$$$$$) - bypassing MFA ($)
Not sure if you are being serious that the other options are comparable to the 3rd for a business
Earlier quoted context omitted.
> Sticking with my example of dealers, let's just say people like dealers are not employed in great numbers in all but the largest financial organisation. Let's also say that there are certain events and certain times of day when the entire dealing desk is, shall we say, "busy and stressed out". There is little scope for a colleague to step in at those times, because everyone is franticly busy on the phones with thei…
The options you are considering seem to be putting over bypassing MFA is: - hire more dealers ($$$$$$$$$) - staff an IT group that is open 24/7 ($$$$$$$$$) - bypassing MFA ($) Not sure if you are being serious that the other options are comparable to the 3rd for a business
Honestly if they are going to just skip MFA everytime it’s a bother they might as well just not use it
Earlier quoted context omitted.
The options you are considering seem to be putting over bypassing MFA is: - hire more dealers ($$$$$$$$$) - staff an IT group that is open 24/7 ($$$$$$$$$) - bypassing MFA ($) Not sure if you are being serious that the other options are comparable to the 3rd for a business
That’s what I mean by optimizing for efficiency. They’d rather not spend the money to operate in a way that allows for them to be secure or redundant. Honestly if they are going to just skip MFA everytime it’s a bother they might as well just not use it
Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…
Block unknown executables on company machines. Google developed Santa to protect themselves: https://github.com/google/santa
> and that's all it takes to steal cookies and tokens post-mfa,
Make post-MFA cookies and tokens short-lived. Require MFA re-authentication at least daily.
> or why even bother with that, if you're running code just make it a reverse shell.
All outbound connections should be strictly monitored, especially from production servers, which should have no ability to connect to the Internet at all. With modern dependency management, that's harder for build servers, but still doable.
Earlier quoted context omitted.
Given that Uber routinely tracked politicians and journos and shared it around the company, and had stood up toolsets to track and evade police so as to facilitate drivers dodging law enforcement, they always were organised crime.
> evade police so as to facilitate drivers dodging law enforcement Isn't this illegal as fuck?