3 ms·
> I trialed major security vendor's enterprise product > just give them to us anyway, because it's easier this way Wow. The state of security is still sad in
by sebazzz 4y ago
> I trialed major security vendor's enterprise product
> just give them to us anyway, because it's easier this way
Wow. The state of security is still sad in our profession, if even major security vendor(s) don't adhere to basic principles like "principle of least privilege".
- ratg13 4y agoIt's not just security vendors, it's everyone. You can't even set up popular software like Tailscale with a github login without it requiring access to your organization's private repositories. It's like mobile phone permissions in the old days where your calculator needs access to your contacts and location. I thought technology companies learned this lesson a decade ago, apparently not.
- justinclift 4y agoHeh. Reminds of one of Symantec's "Enterprise" products. Turned out, if you're logged into the central (on prem) server it has the ability to run commands as root/superuser on any of the connected clients (generally servers themselves). The commands run this way are _not logged_ and don't show up in any system audit logging. After we pointed this out as a security problem in itself, they released a new version that _apparently_ had this functionality removed (was in the release notes). But digging into the new release, they'd just moved the functionality into different binaries and hoped no-one would notice. :( The mind boggles at what some of these places will try.
- slowmovintarget 4y ago"Required functionality..." They're just not telling you who the requirements come from.
- nicolas_t 4y agoMy experience with security vendors is that there's a lot security vendors who check checklist compliance solutions that on paper helps to be compliant but in reality are extremely insecure malwares.