4 ms·
I worked for a US health insurance company for a while, and they were almost this strict. People got away with breaking some of the rules, but it was definitel
by NateEag 5y ago
I worked for a US health insurance company for a while, and they were almost this strict.
People got away with breaking some of the rules, but it was definitely a risk - it was theoretically grounds for dismissal to bring in your own hardware, IIRC, let alone to run unapproved software.
The concern in that case was a PHI (personal health information) breach, which could bring the wrath of the US judicial system down on the company.
So, not top-secret or anything like that, but still very conservative and with decent reasons to be so.
- bradlys 5y agoHuh - I worked in health with HIPPA data issues as well - never had this hardware specific issue. But, we were a group of software engineers who weren't idiots - so... we understood that bringing our own monitor or keyboard/mouse wasn't likely to do anything and not a real risk.
- NateEag 5y agoI have a keyboard that runs custom, open-source software. It would be easy to figure that out about me, if you cared. Say if you found a list of employees and contractors. A sufficiently-motivated attacker could backdoor my firmware with a timer-based exploit (e.g., start your keystroke payload after ten minutes without input events) and I might well not notice if it was a deft-enough change. It might not be worth the cost, given that I might well notice it and it might not pay off even if I didn't. Still - the point is that keyboards are not innocuous, harmless devices that it's a no-brainer to allow.