5 ms·

The right move here would have been to have separate work/personal computers so that this PDF never landed on a system with access to the Ronin network. I know

The right move here would have been to have separate work/personal computers so that this PDF never landed on a system with access to the Ronin network. I know I'm pushing a boulder uphill with that one but it really is the way to go, better for both the individual and the company.

llaolleh 4y ago
I'm in this camp. All employees should be sent a laptop, or work with a remote environment that is isolated from your personal computer.
rchaud 4y ago
what would stop a developer from checking personal email on a work machine?
- pcthrowaway 4y ago
  Or more to the point, what would stop someone from sending malicious documents to the employees' work emails? Figure out a company uses <some-saas> register a phishing domain (e.g. gith.ub) send them an email with important info about their account, and a PDF attachment with more details. If it's that easy to compromise a system all you have to do is get a few employees to open the PDF right?
  - Volundr 4y ago
    And this is exactly why your IT department sends out those simulated phishing emails everyone likes to complain about.
- Volundr 4y ago
  Themselves. I'm saying developers (and employees in general) should not do any personal stuff on work machines or any work stuff on personal machines. This has benefits for the employee, not just the company, in that it keeps the employees personal data out of the hands of the IT department.
  - macintux 4y ago
    Exactly. I was on a meeting a couple of years ago and the co-worker who was presenting his desktop received a personal iMessage that flashed for everyone to see.
    - ptudan 4y ago
      yeah but that's solved by disabling notifications before presenting.
      - macintux 4y ago
        True, but that’s just one of several reasons I’m reluctant to share work and personal activity on a single computer. I certainly wouldn’t conduct a job search on a work computer.
  - pcthrowaway 4y ago
    It makes it a bit harder to travel with two laptops, which is one of the nice advantages of working from home.. but I'm otherwise in support of this. This might just result in employees finding ways to remote access their work computer from their personal computer from wherever they are, but at least that's an additional wall for would-be attackers to hurdle.
  - ptudan 4y ago
    Nahhhhh, I gotta browse the internet to be effective. That requires me logging into random sites with personal logins. I don't install anything personal on my work computer, but I wouldn't hesitate to open an email or pdf from a seemingly trusted source. I don't really blame the dev here. What you propose is a reasonable solution, but I feel like it slams in the face of actual human behavior. Most people act the way I describe, even most tech professionals.
    - mh0pe 4y ago
      I work in conjunction with this segment of the industry. You can do it, but don't be surprised when you can't recover anything in a termination suit.
gowld 4y ago
The right move would be to have separate work / production computers, where the production system requires 2FA, and the finanical production system requres 3FA.
elif 4y ago
So then the attackers can only get my bank password? I think the clear move here should be to avoid pdf, just like the move is to avoid doc

llaolleh 4y ago

I'm in this camp. All employees should be sent a laptop, or work with a remote environment that is isolated from your personal computer.

rchaud 4y ago

what would stop a developer from checking personal email on a work machine?

pcthrowaway 4y ago
Or more to the point, what would stop someone from sending malicious documents to the employees' work emails? Figure out a company uses <some-saas> register a phishing domain (e.g. gith.ub) send them an email with important info about their account, and a PDF attachment with more details. If it's that easy to compromise a system all you have to do is get a few employees to open the PDF right?
- Volundr 4y ago
  And this is exactly why your IT department sends out those simulated phishing emails everyone likes to complain about.
Volundr 4y ago
Themselves. I'm saying developers (and employees in general) should not do any personal stuff on work machines or any work stuff on personal machines. This has benefits for the employee, not just the company, in that it keeps the employees personal data out of the hands of the IT department.
- macintux 4y ago
  Exactly. I was on a meeting a couple of years ago and the co-worker who was presenting his desktop received a personal iMessage that flashed for everyone to see.
  - ptudan 4y ago
    yeah but that's solved by disabling notifications before presenting.
    - macintux 4y ago
      True, but that’s just one of several reasons I’m reluctant to share work and personal activity on a single computer. I certainly wouldn’t conduct a job search on a work computer.
- pcthrowaway 4y ago
  It makes it a bit harder to travel with two laptops, which is one of the nice advantages of working from home.. but I'm otherwise in support of this. This might just result in employees finding ways to remote access their work computer from their personal computer from wherever they are, but at least that's an additional wall for would-be attackers to hurdle.
- ptudan 4y ago
  Nahhhhh, I gotta browse the internet to be effective. That requires me logging into random sites with personal logins. I don't install anything personal on my work computer, but I wouldn't hesitate to open an email or pdf from a seemingly trusted source. I don't really blame the dev here. What you propose is a reasonable solution, but I feel like it slams in the face of actual human behavior. Most people act the way I describe, even most tech professionals.
  - mh0pe 4y ago
    I work in conjunction with this segment of the industry. You can do it, but don't be surprised when you can't recover anything in a termination suit.

gowld 4y ago

The right move would be to have separate work / production computers, where the production system requires 2FA, and the finanical production system requres 3FA.

elif 4y ago

So then the attackers can only get my bank password? I think the clear move here should be to avoid pdf, just like the move is to avoid doc