3 ms·
If a user is logged in with high activity at a time the user should not be working and the only thing that would tick you off is your firewall log you got other
by Zetobal 3y ago
If a user is logged in with high activity at a time the user should not be working and the only thing that would tick you off is your firewall log you got other problems than a remote access feature of vscode that "could" be abused ONLY if the attacker had previously breached your system.
- hutzlibu 3y agoAnd if the attacker is smart and uses active times to hide his activity, then monitoring active connections is a smart way, no?
- Zetobal 3y agoIt's nice to have especially if you need to find a rogue employee but if you catch a bad actor only when he is already exfiltrating, you failed at your job.
- hutzlibu 3y agoSure, but when some damage is already done, you can and must still prevent greater damage. And you have to assume, that one day something fails. So - "monitoring active connections is a smart way, no?"