3 ms·

When that happened to us, we found an article showing Tesla got hacked the same week as us (was aws) and they got the money back, so why not us? We got the mon

• ayewo 4y ago
  You say: "We got the money back and fired the guy who had a jenkins opened without password, granting terminal access to anyone." Why did you fire the employee (?) so quickly? Did he have a history of negligence and/or incompetence on the job and this was the last straw that broke the camel's back?
• oasisbob 4y ago
  Why was that guy running Jenkins without a password?
  • onion2k 4y ago
    Years ago when I actually did any devops running services without a password was common. They would configured to only be accessible using SSH from a locked down IP range. It's far more secure than password based access (if you get it right).
    • 988747 4y ago
      Yes, but that was a design/security choice. What OP described seems like a pure negligence ("setting up authentication is hard, so let's skip it").
• onion2k 4y ago
  It's a shame you failed to learn a lesson about how security is something the entire team is responsible for, and how a mistake like deploying something without a password is a failure of your processes rather than a failure of any one person. By firing the guy all you've done is made everyone paranoid which will slow you down; similar mistakes are still just as likely to happen again.
• deleted 4y ago
  [deleted]
• jve 4y ago
  Well, a guy who learned a thing or two the hard way and won't do that ever again got fired.