14 ms·
That was best practice until maybe 10 years ago. Point the people in charge of that to the NIST standards.
by bongodongobob 1y ago
That was best practice until maybe 10 years ago. Point the people in charge of that to the NIST standards.
- hdgvhicv 1y agoI hear cyber insurance companies (ransomware cover etc) still require outdated standards.
- bongodongobob 1y agoPeople think cyber insurance requirements are hard rules, but they aren't. For the most part, you just need to show effort as it's completely impossible to be 100% compliant with all standards. For example, if you weren't rotating passwords but had proper MFA on your accounts, you're fine. Hell they even have conflicting standards sometimes. I've been through this multiple times when I worked at an MSP. For the most part, leadership just pushes to meet those standards to cya, which makes sense, but as long as you don't demonstrate gross negligence, they'll pay out.