2 ms·
"We'll put them back only when they're safe and secure." I know it's easy to say it, but wouldn't it have been worth making sure those admin tools were 100% se
by axod 18y ago
"We'll put them back only when they're safe and secure."
I know it's easy to say it, but wouldn't it have been worth making sure those admin tools were 100% secure to start with? Do they even need to be accessible to anyone outside the company lan?
- tptacek 18y agoHow do you know if something is "100% secure"? It looks like they did exactly the right thing, which was to make the support tools out-of-band until they can resolve how to secure them long term.
- axod 18y agoIf the admin tools are behind a firewall, then I'd say they are 100% secure, apart from obviously someone breaking in and using a machine in the company, and assuming no other machine has been compromised. If external access is required, then of course some sort of secure vpn, locked down to certain IPs etc etc. Of course we don't know the full facts of how they were able to access the admin system, so it's all pure speculation. It just struck me as a funny statement.
- rcoder 18y agoActually, there's an even easier fix: don't put those tools outside the firewall. Use VPN, or even just a tunneling proxy or SSH to protect your admin console. This is a classic security failure, and their response was both typical and appropriate: take the tools offline, restore the affected accounts, and admit your mistake (in that order).