3 ms·

It'll continue to be a systematic issue until there's an "event" that makes international headlines. I work for a small industrial control company and even the

It'll continue to be a systematic issue until there's an "event" that makes international headlines. I work for a small industrial control company and even the mentality of my coworkers is the security I enforce is an "inconvenience" to their jobs. I've started training another young engineer in training in the work I do since I can't keep up with the workload and he's questioned every single piece of my setup guides to deal with security. "Why do we need to do it this way? Isn't it easier to skip that?" "How come we block this? Why is that feature disabled?" etc. etc. Heck, I've found that vendors are frequently pretty upfront about their devices and hide no secrets that their devices are exploitable if you go against their recommendations for basic security. But as soon as a know-it-all hears of how convenient opening a firewall port is or enabling config access from the public interface its a fight to explain to him why it's a bad idea. Maybe it hasn't blown up yet but we don't want an incident before we do it the right way.

eric_h 9y ago
When I was a wee lad just out of college I worked in a relatively shitty job that was basically 1/2 tech support consulting and 1/2 software development. My boss insisted that every single server we managed have the same 7 character root password (both our own and for clients) and that those machines be exposed to the open internet (with root ssh and other remote access protocols enabled!) accessible via that password. Since a number of those machines were inevitably pwned, and had to be cleaned up by none other than yours truly, I learned the extremely painful lesson of what happens when you sacrifice security in the name of usability (it was so easy - you only need to remember one short password!) As an aside - he was just as bad a boss on the software development side of the job. On the bright side it was interesting observing how various automated attacks succeeded in installing botnet C&C software, and how it worked to conceal itself. Edit: Of course I'll never know about the most sophisticated versions that escaped my detection :) Fortunately that was more than a decade ago.

eric_h 9y ago

When I was a wee lad just out of college I worked in a relatively shitty job that was basically 1/2 tech support consulting and 1/2 software development. My boss insisted that every single server we managed have the same 7 character root password (both our own and for clients) and that those machines be exposed to the open internet (with root ssh and other remote access protocols enabled!) accessible via that password. Since a number of those machines were inevitably pwned, and had to be cleaned up by none other than yours truly, I learned the extremely painful lesson of what happens when you sacrifice security in the name of usability (it was so easy - you only need to remember one short password!) As an aside - he was just as bad a boss on the software development side of the job. On the bright side it was interesting observing how various automated attacks succeeded in installing botnet C&C software, and how it worked to conceal itself. Edit: Of course I'll never know about the most sophisticated versions that escaped my detection :) Fortunately that was more than a decade ago.