3 ms·

Yeah I’m also pissed off that they failed to have policy in place to prevent an insider threat and deal with it afterwards.

• InTheArena 5y ago
  It's almost impossible to prevent a trusted insider attack. It is possible to quickly identify and shut down a insider. I think the second is a bigger issue - they did (obv) identify the attacker - but they had the FBI involved at that point.
  • GekkePrutser 5y ago
    No it's virtually impossible to prevent it. It's very important to detect it though and to have a playbook in place on how to deal with it.
    • newsclues 5y ago
      Can’t prevent everything true but they pulled a Robert Hansen!
  • newsclues 5y ago
    Good policy will prevent you from assigning the person responsible for the breach to the team to investigate themselves, I think the FBI learned that the hard way. Ubiquiti did not have good security policy as stated in the hacker news post from 3 months ago (cred open to many people etc). While it’s impossible to completely prevent this, best practices were not followed.