5 ms·
This shit happens all the time. Old school one when I was a security consultant for a bit (pre-automated pentest scammers). Medium size regulated fintech. Doma
by gw99 4y ago
This shit happens all the time.
Old school one when I was a security consultant for a bit (pre-automated pentest scammers). Medium size regulated fintech. Domain admin passwords and admin accounts were stuck on post it notes on a board in the machine room. If you went over the road to the college, asked to use the toilet, which they seemed fine with, and poked your 200mm lens out of the bathroom window you could snap them all.
Don't assume that level of competence improved with addition of technology.
- chaps 4y agoYep :) Did some consulting for an org that did managed IT and found that they wrote on a white board all of their passwords. Wrote them an email basically telling them "hey maybe you should erase that". May or may not have billed them for the time it took to write that email. They put a piece of paper over the passwords in response.
- FredPret 4y agoIn fact we now have even better camera lenses!
- ethbr0 4y agoEveryone complains about post-it notes, but the physical proximity requirement to read them isn't nothing. E.g. compared to network-accessible files. At least, until you have a network-attached webcam pointed at your whiteboard. But the solution to the webcam problem is to write its access credentials on your whiteboard, thus forming a circular and perfectly secure loop.
- gw99 4y agoJust stick an Amazon t shirt on, a reflective yellow waistcoat and a box and you can walk into most SMEs without anyone blinking an eye. I've seen it done hundreds of times...
- baxtr 4y agoIs there a corresponding ISO control for this?
- gw99 4y agoThere probably is but ISO certs are just paperwork filed. Reality is different.
- throwaway290 4y agoAt least falls under 31000's framework for identifying and dealing with risk
- bergenty 4y agoWhy would you have seen it done 100s of times. Are you a professional thief?
- lupire 4y agoPerfectly circular 0 the first time you join a meeting.
- chaps 4y agoHeh, sometimes, sure. In a separate comment I mention a company with whiteboard passwords. What I didn't mention is that they had a glass wall that you could look into from a well-traffick'd hallway. One of the larger companies that worked at the office (not any longer) rhymes with loinbase. Also, I no-joke heard of a company that absolutely, unironically, did the webcam thing with RSA tokens.
- gwbas1c 4y agoI used to put fake password stickies on my monitor at my first job out of school. No one ever said anything. My current manager is delightfully paranoid about security, so maybe I'll do it again to see if he says anything.