4 ms·

I'm not sure what's more depressing, that they didn't think that someone exfiltrating the data was an issue as long as they didn't lose it, or the fact that eve

• giantg2 4y ago
  Oh, to be fair I should mention that it was an internal system. External threat actors were not a major concern. However, we had trading desk developers with access to the prd system and their own development space. The major concern in my mind is an absent minded copy/paste of a drop table, maybe a disgruntled employee.
  • galdosdi 4y ago
    > Oh, to be fair I should mention that it was an internal system. External threat actors were not a major concern. Preaching to the choir, but that's simple black and white thinking. Once an attacker has gotten in, it's better if at least there's less damage they can do. The more damage an insider could do, the more damage an outsider who social engineers some credentials can do.
    • giantg2 4y ago
      I understand defense in depth. I'm just mentioning it because is incalculable worse if those pages were exposed externally since any script kiddie would be able to pwn the site immediately.