3 ms·
.pst? Microsoft Outlook? Really? Wasn't that software package very exploitable in the 08-12 timeframe? It seems likely the server was some version of Exchange.
by OliverJones 10y ago
.pst? Microsoft Outlook? Really? Wasn't that software package very exploitable in the 08-12 timeframe? It seems likely the server was some version of Exchange.
Why would anybody in her right mind -- not to mention a powerful and visible government official -- operate her own email server?
In that timeframe there were several SaaS email providers that were very secure. A couple were even certified as HIPAA Associated Business Entities (for certain limited use cases). That's a high standard of security.
It's not hard to believe that servers for staff use operated by a department of the US federal government were ancient, poorly maintained, and vulnerable. It's almost certain they had unreasonable usage limitations. "Sorry, your mailbox contains 24 / 25 megabytes so it's almost full." Plus, they probably thought they were cool because they had a T1.
But why couldn't a powerful person like Secretary Clinton figure out how to contract with a competent SaaS? I bet the big email provider on Amphitheater Road would have jumped at this project.
Finally, how come nobody involved in this cluster*k has ever answered the question "why?"
- smileysteve 10y ago> In that timeframe there were several SaaS email providers that were very secure. A couple were even certified as HIPAA Associated Business Entities (for certain limited use cases). That's a high standard of security. Thank you for saying this. In this crises we're comparing a government IT department that can't keep audit logs via .pst, imap, or exchange and comparing it to a non-cloud provided private email server. Both should be considered inept in 2008 and certainly now. Unfortunately, the assumption is that the government IT is somehow trustworthy.