4 ms·
> we were able to thwart the attack through [...] physical security keys issued to every employee that are required to access all our applications I hope you a
by psanford 4y ago
> we were able to thwart the attack through [...] physical security keys issued to every employee that are required to access all our applications
I hope you are paying attention, Twilio. WebAuthN tokens are an effective phishing mitigation, unlike security/phishing training for employees.
- tialaramex 4y agoRight. Employees hate the training and it isn't very effective. WebAuthn should be a no brainer.
- ajross 4y ago> unlike security/phishing training for employees Per the article, only three of 76 targetted employees were fooled by what can reasonably be described as a best-in-class phishing attack. That's actually pretty good[1], and implies that someone trained them pretty well. [1] Though surely Cloudflare employees are, by the nature of their business area, going to be a ton more sophisticated about this than median corporate folks.
- yjftsjthsd-h 4y agoBut surely that makes it even more compelling; it's incredibly good and they still got breached. The promise of hardware tokens is that you can survive even that happening, because humans are and always will be the weak link in the chain and this is an actual mitigation against even that.
- fsckboy 4y agobut they still didn't get breached
- yjftsjthsd-h 4y agoYes I apologize; I should have said "tricked", perhaps.