3 ms·
I understand your point but how do you explain the complete absence of database security controls? That part is on Newsblur. Defense in depth is important!
by rank0 5y ago
I understand your point but how do you explain the complete absence of database security controls? That part is on Newsblur. Defense in depth is important!
- jacquesm 5y agoYes, they absolutely have some culpability, but making a change like this without alerting the administrator of the system is the rough equivalent of any process with 'root' privileges on any one of your servers suddenly executing an iptables command to allow all access. You'd only know about it because you got hacked. Such drastic changes to the security model should only be one after explicit instruction. The number of companies that operate without access controls between servers on the same segment is unfortunately quite large, database security controls are - again - more often than not left at their default setting and those too are quite often insecure. Defense in depth always has limited depth, though I totally agree that running a database without access controls is not the way to go.