5 ms·

Pour one out for our fellow sys admins & security teams that are going to be working late into the night. They took down their Slack so I wonder what out-of-ban

Pour one out for our fellow sys admins & security teams that are going to be working late into the night. They took down their Slack so I wonder what out-of-band comma they’re using. EDIT: Comms not comma. I'll leave the typo because I LOVE bombcar's comment about the semicolon. Confused at first, but I smiled

pm90 4y ago
Yup, gonna be a rough night for all involved.
bombcar 4y ago
Probably a semicolon! (I’d assume going to text messaging to set something up, which is why you should know enough about your immediate coworkers to verify their identity via non-public information.)
- gnu8 4y ago
  A reasonably sophisticated attacker could arrange for the entire team to get SIM-swapped and suspended from Facebook when they launch an attack. If only there were some way to have a central rallying point for everyone to meet at. Perhaps some sort of a structure, with the company's name on it, and it would have places to sit inside, with computers connected to the company's infrastructure to use.
  - bombcar 4y ago
    In the old days you’d have physical restrictions on access to the datacenter - in a major breach you’d get there physically and shut it down and disconnect it. With everything cloud now, how do you recover your cloud account of the master got compromised?
    - fjfbsufhdvfy 4y ago
      That's the fun part, you don't!
    - zmgsabst 4y ago
      For someone Uber’s size, you call your AWS rep and co-ordinate with AWS security.
      - mrsalt 4y ago
        Could the CTO or some other employee go to Amazon's office to do something like this? I genuinely wonder.
      - Griffinsauce 4y ago
        How do they verify your identity?
  - CPLX 4y ago
    Who controls the database of RFID cards allowed to open the doors?
    - bombcar 4y ago
      Usually the datacenter was manned (sometimes by guys with guns) and they had various mechanisms for ID verifications. And they had an entirely separate IT setup that wasn’t related to yours.
    - wumpus 4y ago
      My not super-secure datacenter requires either a palm-print plus RFID card, or showing ID to a human.
staticassertion 4y ago
At Dropbox we had an explicit fallback on the DFIR team for the situation where our normal communication methods were considered compromised (not going to give details, obviously). I would hope that most security teams at a company of similar size have discussed this situation, it's not at all uncommon for attackers to sit in on calls, read messages between security people, or even access the SIEM to see what alerts are going off.
jpgvm 4y ago
Generally speaking infra and sec folk tend to have OOB comms setup because of frequency of Slack outages

pm90 4y ago

Yup, gonna be a rough night for all involved.

bombcar 4y ago

Probably a semicolon! (I’d assume going to text messaging to set something up, which is why you should know enough about your immediate coworkers to verify their identity via non-public information.)

gnu8 4y ago
A reasonably sophisticated attacker could arrange for the entire team to get SIM-swapped and suspended from Facebook when they launch an attack. If only there were some way to have a central rallying point for everyone to meet at. Perhaps some sort of a structure, with the company's name on it, and it would have places to sit inside, with computers connected to the company's infrastructure to use.
- bombcar 4y ago
  In the old days you’d have physical restrictions on access to the datacenter - in a major breach you’d get there physically and shut it down and disconnect it. With everything cloud now, how do you recover your cloud account of the master got compromised?
  - fjfbsufhdvfy 4y ago
    That's the fun part, you don't!
  - zmgsabst 4y ago
    For someone Uber’s size, you call your AWS rep and co-ordinate with AWS security.
    - mrsalt 4y ago
      Could the CTO or some other employee go to Amazon's office to do something like this? I genuinely wonder.
    - Griffinsauce 4y ago
      How do they verify your identity?
- CPLX 4y ago
  Who controls the database of RFID cards allowed to open the doors?
  - bombcar 4y ago
    Usually the datacenter was manned (sometimes by guys with guns) and they had various mechanisms for ID verifications. And they had an entirely separate IT setup that wasn’t related to yours.
  - wumpus 4y ago
    My not super-secure datacenter requires either a palm-print plus RFID card, or showing ID to a human.

staticassertion 4y ago

At Dropbox we had an explicit fallback on the DFIR team for the situation where our normal communication methods were considered compromised (not going to give details, obviously). I would hope that most security teams at a company of similar size have discussed this situation, it's not at all uncommon for attackers to sit in on calls, read messages between security people, or even access the SIEM to see what alerts are going off.

jpgvm 4y ago

Generally speaking infra and sec folk tend to have OOB comms setup because of frequency of Slack outages