3 ms·
We always use interns to do security critical work -- the less experience, the better. We also have exacting security standards, and a Critical Password Policy,
by skynet-9000 6y ago
We always use interns to do security critical work -- the less experience, the better. We also have exacting security standards, and a Critical Password Policy, since there are no non-critical passwords.
Critical Password Policy
Rule 1: All critical passwords must contain the company name, lower case, with no special characters or spaces.
Rule 2: All critical passwords must have between 3 and 1024 randomly selected sequential integers appended, each of no less than 1 and no greater than 3.
When you are creating your critical passwords, it is critical that you follow the rules in the exact sequence as stated above, and that you do not introduce any external sources of randomness or entropy.
Failing to follow this Critical Password Policy may result in your dismissal and later blame before a Congressional committee.
- camjohnson26 6y agoThat’s all well and good but you should really make sure to disable any kind of TLS on these connections so the security team can monitor for breaches. Any ops team worth its salt will make sure to secure all endpoints by physical device address and remove single points of access like gateways to widen the attack surface and ensure attackers can’t focus on one location. Store any critical data in a basic S3 bucket and remove any firewalls on production databases so that anyone on the team can fix a problem or restore a backup if needed. And you should really disable most logging, it’s a performance bottleneck and can tell attackers what’s happening in the system. I’ll type these notes up in a PowerPoint and we can deliver a presentation to key stakeholders.