3 ms·

> Krebs has known since December when Sharp was arrested that: Criminal Accusations <> Facts until proven in a court of law. All Krebs knows at this point is S

> Krebs has known since December when Sharp was arrested that: Criminal Accusations <> Facts until proven in a court of law. All Krebs knows at this point is Sharp was arrested. And what we all don’t know at this point is whether Ubiquiti is competent enough to have unfettered access to all their customer networks because they failed to defend against insider threats.

ricardobeat 5y ago
Is it even possible for a company to defend itself from sabotage by the person who is presumably responsible for their security? Seems illogical.
- stormbrew 5y ago
  They can design devices that are resilient to attacks by even themselves. That's hard when your whole pitch is "your devices are connected to the cloud!" though. But maybe that's the problem.
- CodeWriter23 5y ago
  > Is it even possible for a company to defend itself from sabotage by the person who is presumably responsible for their security? Seems illogical. Off the top of my head: a) don't force your clients to add their networks to be accessible by your cloud, this was their entirely huge mistake. or by design to enable spying activities. the same way I can log into unifi and set a switch port in promiscuous mode and forward the traffic to my remote ip, so can they. b) two people required for secure access to sensitive systems. c) sensitive gear on-premise under constant video surveillance. d) logging to remote servers under control of "internal security" not "security", regularly monitored by "internal security". Companies do this and more. They do it by contemplating a solution to a problem rather than dismissing the solution as "illogical".
- vba616 5y ago
  Remember "Apple’s insider-trading policy enforcer accused of insider trading"? He got inside information from being...chairman of the committee that managed disclosure of sensitive information. https://arstechnica.com/tech-policy/2019/02/lawyer-who-wrote-apples-insider-trading-policy-accused-of-insider-trading/ https://arstechnica.com/tech-policy/2019/02/lawyer-who-wrote...
rekoil 4y ago
But shouldn't good journalists verify the identity of their sources before publishing stories?

ricardobeat 5y ago

Is it even possible for a company to defend itself from sabotage by the person who is presumably responsible for their security? Seems illogical.

stormbrew 5y ago
They can design devices that are resilient to attacks by even themselves. That's hard when your whole pitch is "your devices are connected to the cloud!" though. But maybe that's the problem.
CodeWriter23 5y ago
> Is it even possible for a company to defend itself from sabotage by the person who is presumably responsible for their security? Seems illogical. Off the top of my head: a) don't force your clients to add their networks to be accessible by your cloud, this was their entirely huge mistake. or by design to enable spying activities. the same way I can log into unifi and set a switch port in promiscuous mode and forward the traffic to my remote ip, so can they. b) two people required for secure access to sensitive systems. c) sensitive gear on-premise under constant video surveillance. d) logging to remote servers under control of "internal security" not "security", regularly monitored by "internal security". Companies do this and more. They do it by contemplating a solution to a problem rather than dismissing the solution as "illogical".
vba616 5y ago
Remember "Apple’s insider-trading policy enforcer accused of insider trading"? He got inside information from being...chairman of the committee that managed disclosure of sensitive information. https://arstechnica.com/tech-policy/2019/02/lawyer-who-wrote-apples-insider-trading-policy-accused-of-insider-trading/ https://arstechnica.com/tech-policy/2019/02/lawyer-who-wrote...

rekoil 4y ago

But shouldn't good journalists verify the identity of their sources before publishing stories?