3 ms·

That's the point, you have to pivot. If you don't have to jump through another host or two to get unfettered database access from web tier, you're doing it wro

• sillysaurus3 9y ago
  It wouldn't have changed Equifax's situation at all. Everyone would still be just as outraged. It occurs to me that maybe it might seem like pivoting is a big process that takes months. In reality you can map out an internal network within a few hours. Most people keep the servers at the edge of their network meticulously up to date. Once you're inside, you find way more old software. Not to mention creds just laying around the system in many cases since the devs don't expect anybody to be able to access them. I feel like the worst offense Equifax could be accused of is not getting regular pentests. A netpen would have caught the outdated Struts issue, and they had money to get monthly tests. But very few of us get regular pentests.
  • occultist_throw 9y ago
    That's one thing the org I work for does right. We do have monthly tests, scans, and network BGP issues. And our governmental side has a different set of scans, which also include system security scans. Whomever the oncall is, ends up doing them during the week. It's usually pretty quick, but can turn into a slog. Oh, and all our machines are updated appropriately, not just the border machines. There are some services we're not able to adequately update, like FreeRadius - but for each of those we review the criticality and determine if we need the resources to make it work (aka: remote priv exploit)