3 ms·

This actually comes as a surprise to me. Because they are following most infosec security best practices. A family member works for them in financial consulting

by yardie 9y ago

This actually comes as a surprise to me. Because they are following most infosec security best practices. A family member works for them in financial consulting. She showed me some of the equipment in her deployment bag including an MFA keyfob, a mifi (never touch the client network), privacy screen filters. Compared to your average remote employee network, it’s pretty rigorous. And comes with loads of training. I wouldn’t doubt this security breach was targeted as extremely sophisticated. Just casually sending an email attachment would not have worked.

edraferi 9y ago
Problem is, the place is huge... 263,900 employees as of this year. [0] With that many people, you'll inevitably have numbskulls who upload critical security information to public websites. You'll also have so many services deployed that some of them will be wide open. At that scale, even near-perfect controls will have enough chinks to sink you. [0] https://en.wikipedia.org/wiki/Deloitte https://en.wikipedia.org/wiki/Deloitte
jaclaz 9y ago
As a side note - and not necessarily being this the case - I have seen in my experience companies/institutions that have reasonable "good" security policies and provisions at user level (including the "common" employees/contractors) and then a much more lax one at a higher level (like - literally - having the login/password for every system scribbled on a post-it pinned to the IT administrator monitor or allowing some top executives access the systems without login/password - or with "123456" - because it was inconvenient for them to use a secure method).
- yardie 9y ago
  In the interest of security we've had to take on a white glove approach to senior execs. No we won't allow you to use the same shitty password. Their assistants handle the password changes.
  - jaclaz 9y ago
    Sure, and - actual anecdata, names changed or omitted to protect both the innocent and the guilty,I was present (talking with a top-level executive in a private largish - though not very very large - firm about a possible consulting contract with them) when he attempted accessing his e-mail or something and muttered something like: Strupid IT guys,they must have changed the password again! Then called his secretary/assistant (with the speakerphone on): Hey, Susan, what is the new password? And Susan, promptly replied: It is "123456", I have written it on a post-it I put in your left top drawer. Admittedly the above happened a few years ago (roughly 2008 or 2009), but I wouldn't be so sure that anything has changed much in the meantime.

by yardie 9y ago

edraferi 9y ago

Problem is, the place is huge... 263,900 employees as of this year. [0] With that many people, you'll inevitably have numbskulls who upload critical security information to public websites. You'll also have so many services deployed that some of them will be wide open. At that scale, even near-perfect controls will have enough chinks to sink you. [0] https://en.wikipedia.org/wiki/Deloitte https://en.wikipedia.org/wiki/Deloitte

jaclaz 9y ago

As a side note - and not necessarily being this the case - I have seen in my experience companies/institutions that have reasonable "good" security policies and provisions at user level (including the "common" employees/contractors) and then a much more lax one at a higher level (like - literally - having the login/password for every system scribbled on a post-it pinned to the IT administrator monitor or allowing some top executives access the systems without login/password - or with "123456" - because it was inconvenient for them to use a secure method).

yardie 9y ago
In the interest of security we've had to take on a white glove approach to senior execs. No we won't allow you to use the same shitty password. Their assistants handle the password changes.
- jaclaz 9y ago
  Sure, and - actual anecdata, names changed or omitted to protect both the innocent and the guilty,I was present (talking with a top-level executive in a private largish - though not very very large - firm about a possible consulting contract with them) when he attempted accessing his e-mail or something and muttered something like: Strupid IT guys,they must have changed the password again! Then called his secretary/assistant (with the speakerphone on): Hey, Susan, what is the new password? And Susan, promptly replied: It is "123456", I have written it on a post-it I put in your left top drawer. Admittedly the above happened a few years ago (roughly 2008 or 2009), but I wouldn't be so sure that anything has changed much in the meantime.