2 ms·
> which makes it all so much more ironic how completely they have been hacked. Nope, not really. It just takes one mistake and you're pwned. Imagine giving the
by RamblingCTO 3y ago
> which makes it all so much more ironic how completely they have been hacked.
Nope, not really. It just takes one mistake and you're pwned. Imagine giving the intern a small project, you're losing your head due to your main project, no time to supervise. Boom.
/e: Or imagine an update in one of your libs/apps. In order to not to be hacked you need to make everything right. In order to hack you just need to find one mistake. Well, kinda, but you know what I mean
- Leo_Germond 3y agoI guess they meant paradoxical. Being a security company they are juicy target for an attacker's rep, meaning they are in the situation where they are both more protected than usual but also more at risk. That's the arm's race paradox I guess.
- _23sd 3y agoIt only takes one mistake, but this was a pretty easy one to prevent. At a mature company with a decent security program, creating an internet facing Jenkins instance wouldn't have been approved by IT, doesn't matter if it was an intern with an overworked manager trying to set it up. So it is pretty bad that a security company failed at something as basic as minimizing their attack surface (and possibly not sufficient segmentation between the dev environment and customer data, but the post is not very detailed on that part). Not surprising, though.