3 ms·
More a sad commentary of how many people think there's some magic bullet of security practices and if they just follow those, then they won't be hacked. If you
by Johnny555 9y ago
More a sad commentary of how many people think there's some magic bullet of security practices and if they just follow those, then they won't be hacked.
If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems.
Otherwise, you'll be like a former coworker that refused to secure internal systems because "We paid a lot of money for our firewall, it's going to block any hackers". It took me less than 30 minutes on my first day to hack the login passwords of senior executives because they logged into a non-SSL reporting server (and I did through a simple MAC overflow attack on a network switch from a network port in the break room)
- bo1024 9y ago> If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems. I see a big difference between preparing for the event of a hack, and believing that a hack is inevitable no matter what practices are in place.
- Johnny555 9y agoHow do you get your CEO to pay for the monitoring and other breach preparation if you've just told him that "We have air-tight security, we cannot get hacked"? CSO: We have airtight security, we cannot get hacked. CEO: Great! CSO: Please approve and fund this plan to handle a breach in case we are hacked. CEO: But you just told me we can't get hacked. CSO: Right, it's impossible. CEO: So why do we need to spend money preparing for it? CSO: Just in case. CEO: Just in case what? You just told me it can't happen. That seems a little like asking for money to prepare for an alien invasion or a zombie attack.
- dboreham 9y agoProbably the CEO would have read the document their Insurance Carrier made him sign that details the measures they need to keep cyber cover valid and therefore this conversation wouldn't happen.