3 ms·
> Working from a point of "I don't trust my employees" is very painful for many reasons. It’s probably the hardest problem to solve in general, but it’s exactl
by AmericanChopper 7y ago
> Working from a point of "I don't trust my employees" is very painful for many reasons.
It’s probably the hardest problem to solve in general, but it’s exactly what a well designed separation of duties is supposed to address.
- tptacek 7y agoI have never even heard of an internal site-wide pentest that failed.
- dmix 7y agoI'm guessing Coinbase hiring a pentester and giving them 'employee level access' would be a needless formality?
- tptacek 7y agoPeople do internal pentests even though everyone knows the pentesters will win; you still learn something from the experience.
- dmix 7y agoOf course, I was just being cute.
- AmericanChopper 7y agoYou’ll never be able to prevent privileged insiders, or their accounts, from being able to cause damage. But I have worked with organisations where internal tests were not able to compromise the most critical assets, and where the outcome of the tests was those assets become even more well protected. Which is really the best outcome you could be hoping for with these kinds of engagements, imo.