2 ms·
I wonder why putting software on every machine, instead of relying on a good firewall and network separation. Granted, you are still vulnerable of physical att
by alerighi 2y ago
I wonder why putting software on every machine, instead of relying on a good firewall and network separation.
Granted, you are still vulnerable of physical attacks (i.e. the person coming with an USB stick) but I would say much more difficult, and if you put firewalls also between compartment of internal networks even difficult.
Also, I think the use of Windows in critical settings is not a good choice, and to me we had a demonstrations. For who says the same could have happened to Linux, yes but you could have mitigated it. For example, to me a Linux system used in critical settings shall have a root read-only root filesystem, on Windows you can't. Thus the worse you would had is to reboot the machine to restore it.
- MattPalmer1086 2y agoA common attack vector is phishing, where someone clicks on an email link and gets compromised or supplies credentials on a spoofed login page. External firewalls cannot help you much there. Segmenting your internal network is a good defence against lots of attacks, to limit the blast radius, but it's hard and expensive to do a lot of it in corporate environments.
- numpad0 2y agoThere are no good firewall in the market. It's always the pretend-firewall that becomes the vector.
- whatevertrevor 2y agoYup as you say, if you go for a state of the art firewall, then that firewall also becomes a point of failure. Unfortunately complex problems don't go away by saying the word "decentralize".
- eschneider 2y agoThe physical security of computers in , say a hospital, is poor. You can't rely on random people not getting access to a logged in computer.
- shados 2y agoYou highly overestimate the capabilities of the average IT person working for a hospital. I'm sure some could do it. But most who can work elsewhere.