4 ms·
Dude, forget a pentest, have a security architect look things over. Simple segmentation and endpoint firewall witha good edr might have stopped this. Everyone m
by badrabbit 7y ago
Dude, forget a pentest, have a security architect look things over. Simple segmentation and endpoint firewall witha good edr might have stopped this. Everyone misses the basics, a lot of networks were pieced together 10+ years ago when people were not as security conscious as they are now.
- SlowRobotAhead 7y agoOur first pen test, before I took over as CTO... We had a JSON file with admin credentials on a shared drive. IT company needed it there so some tool could log in as admin and do some robot work. Fired them, and good riddance. But... STUPID SIMPLE things can get overlooked for years until you have someone else come in and test. +1 for pentests.
- badrabbit 7y agoFor sure, I wasn't disagreeing. I meant have someone look at your architecture and make sure best practices are followed and insane designs don't exist before you pay for a pentester . pentest results can be used to adjust architecture but a pentester will show you one or a few ways they acheived the objective, they won't do a hollistic review of architecture,procedures,practices,etc...
- pc86 7y agoSo after firing the vendor, who on your side got fired for allowing it in the first place?
- presumably 7y agoThe way you phrase the question is odd/misleading. GP wrote that he replaced the previous CTO. Before firing the vendor, the responsible party on their side had already left the role.
- SlowRobotAhead 7y agoLike many orgs that don't know any better, our CFO thought because he was good at excel that he was qualified to direct IT. That is no longer the case. To answer your question though, you know how hard it is to fire a CFO? Let me know if you have any tips.
- badrabbit 7y agoWhy would anyone get fired, explicit approval and imppicit incompetence should be handled differently. If pentests get people fired, no one wants a pentest. Refusing to accept and resolve pentest results can be fireable but a pentest is suppose to help you improve what you have already.