4 ms·
The question is not to keep your data safe, but to know that there is a breach to begin with.
by rat9988 3y ago
The question is not to keep your data safe, but to know that there is a breach to begin with.
- Zetobal 3y agoIf a user is logged in with high activity at a time the user should not be working and the only thing that would tick you off is your firewall log you got other problems than a remote access feature of vscode that "could" be abused ONLY if the attacker had previously breached your system.
- hutzlibu 3y agoAnd if the attacker is smart and uses active times to hide his activity, then monitoring active connections is a smart way, no?
- Zetobal 3y agoIt's nice to have especially if you need to find a rogue employee but if you catch a bad actor only when he is already exfiltrating, you failed at your job.
- hutzlibu 3y agoSure, but when some damage is already done, you can and must still prevent greater damage. And you have to assume, that one day something fails. So - "monitoring active connections is a smart way, no?"