4 ms·
If someone can access your machines physically, can login, play with an USB Stick or download malware. No form of monitoring your logs will keep your data safe.
by Zetobal 3y ago
If someone can access your machines physically, can login, play with an USB Stick or download malware. No form of monitoring your logs will keep your data safe.
- rat9988 3y agoThe question is not to keep your data safe, but to know that there is a breach to begin with.
- Zetobal 3y agoIf a user is logged in with high activity at a time the user should not be working and the only thing that would tick you off is your firewall log you got other problems than a remote access feature of vscode that "could" be abused ONLY if the attacker had previously breached your system.
- hutzlibu 3y agoAnd if the attacker is smart and uses active times to hide his activity, then monitoring active connections is a smart way, no?
- Zetobal 3y agoIt's nice to have especially if you need to find a rogue employee but if you catch a bad actor only when he is already exfiltrating, you failed at your job.
- hutzlibu 3y agoSure, but when some damage is already done, you can and must still prevent greater damage. And you have to assume, that one day something fails. So - "monitoring active connections is a smart way, no?"