2 ms·
I can't even imagine what kind of abysmal state of security must be employed when a "security expect" can't see any difference between a legitimate access to th
by sakopov 15y ago
I can't even imagine what kind of abysmal state of security must be employed when a "security expect" can't see any difference between a legitimate access to the system and a cyber attack and then eventually come to conclusion that it was a typical hardware failure.
- dredmorbius 15y agoTruth is, most/many publicly accessible (or even private) technological infrastructures it's very difficult to discern between external attacks and self-inflicted damage, or even system/component failures. It's probable that you're under a constant low-level attack -- bots and script kiddies at the very least. If your infrastructure's interesting enough, there may even be targeted attacks. Your own ops / eng team is probably your biggest threat (just plain shit happening, though intentional damage does happen). Parts breaking, or various buckets overflowing generally don't help matters much. Since you're talking about a system with usually at a minimum hundreds of discrete subsystems, let alone the number of physical components, interconnects, and external dependencies, it's difficult to monitor it all let alone have a solid sense of what's going on. Your best bet is some overall metric of system/site health. I worked for ... a large Internet presence where an apparently unauthorized access to an admin tool (unknown username) and resetting of system parameters was traced (with the help of the internal security team) ... to our own office. The dipshit doing this sat two chairs over but hadn't piped up during several days' worth of "WTF is going on / who's accessing this system as 'username'". Don't ask me how my Thanksgiving went.
- adestefan 15y agoYou're assuming that by calling themselves an expert that they are an expert.