5 ms·

I've been told we'll fail a pci audit unless we go into the datacenter and replace all the blue cat5 with a different colour. Nothing is apparently too silly.

omginternets 3y ago
Can you tell us the full story?
- technion 3y ago
  That's pretty much the story. It came in as a high priority issue with no context. I asked for clarification, he asked if we wanted to fail the the audit. I changed them to red and he wrote a thing about we were more secure now.
  - deleted 3y ago
    [deleted]
- gizmo686 3y ago
  I've worked in a datacenter that had a few different networks that must not touch each other. One of the precautions we took was color coded ethernet cables. A blue cable plugged into a red server will cause an incident if someone sees it; even if the other end is another red server 1U down.
  - Wowfunhappy 3y ago
    Honestly, that seems clever, I like it!
  - LinuxBender 3y ago
    This was a common practice in the military for secure and insecure feeds. I also saw this practice in telco.
oliwarner 3y ago
Yeah you don't even have to get silly before you reach impossible. One client's compliance jobsworth demanded a tour of our datacentre (AWS) to inspect physical security for low grade employee PII (email, name). I was younger and poorer then so bent over backwards to still get told "er, no thank you" from Amazon. Client's security weren't happy with third party security certifications (of which AWS has most) so they reported up that we were likely hiding something devious. I think they'd had some sort of physical breach in the past but it just makes using an external service supplier untenable if you're going to treat security like it's 1970. I think we still got that contract but it took high-level meetings to ELI5 modern infrastructure's features and limitations. We've had others rock up at third sales meetings (pretty advanced) saying they now "need" source and data design before they sign. One asked me to get a criminal record check. To reiterate, we're storing light employee data and everybody knows and understands that, but some people just seem to treat all data exchange as nuclear waste.

omginternets 3y ago

Can you tell us the full story?

technion 3y ago
That's pretty much the story. It came in as a high priority issue with no context. I asked for clarification, he asked if we wanted to fail the the audit. I changed them to red and he wrote a thing about we were more secure now.
- deleted 3y ago
  [deleted]
gizmo686 3y ago
I've worked in a datacenter that had a few different networks that must not touch each other. One of the precautions we took was color coded ethernet cables. A blue cable plugged into a red server will cause an incident if someone sees it; even if the other end is another red server 1U down.
- Wowfunhappy 3y ago
  Honestly, that seems clever, I like it!
- LinuxBender 3y ago
  This was a common practice in the military for secure and insecure feeds. I also saw this practice in telco.

oliwarner 3y ago

Yeah you don't even have to get silly before you reach impossible. One client's compliance jobsworth demanded a tour of our datacentre (AWS) to inspect physical security for low grade employee PII (email, name). I was younger and poorer then so bent over backwards to still get told "er, no thank you" from Amazon. Client's security weren't happy with third party security certifications (of which AWS has most) so they reported up that we were likely hiding something devious. I think they'd had some sort of physical breach in the past but it just makes using an external service supplier untenable if you're going to treat security like it's 1970. I think we still got that contract but it took high-level meetings to ELI5 modern infrastructure's features and limitations. We've had others rock up at third sales meetings (pretty advanced) saying they now "need" source and data design before they sign. One asked me to get a criminal record check. To reiterate, we're storing light employee data and everybody knows and understands that, but some people just seem to treat all data exchange as nuclear waste.