3 ms·
This is a silly standard that nobody is held to in the real world. Nearly every company can have a breach due to an intern or another employee leaking credentia
by lawnchair_larry 6y ago
This is a silly standard that nobody is held to in the real world. Nearly every company can have a breach due to an intern or another employee leaking credentials. There’s nothing the CEO can do about that.
It is often the case after these breaches that HNers start assigning blame in ways that indicate their lack of practical experience in the security world. After 20 years working in security, from startups to fortune 500s, including the most well funded security teams in the world, EVERYONE has stupid password problems in some corners of their company. The password leak was absolutely not the CEOs mistake.
- camjohnson26 6y agoWith all due respect to your experience in the industry, if knowing that an intern’s password is solarwinds123 is enough for an attacker to sign and release an unauthorized binary and publish it to hundreds of customers, then that’s an operational problem that the CEO is ultimately responsible for.
- lawnchair_larry 6y agoWell, nothing like that even happened, so why are we talking about it? solarwinds123 was a password for a public ftp server. It did not let anyone sign anything and it didn’t push updates out. It isn’t even related to the solarwinds breach.
- camjohnson26 6y agoThat’s the reason they’re having the hearing, the point is that the CEO is bringing this up and blaming an intern for the massive breach when it’s pretty clearly either a red herring or a complete lapse in security.