4 ms·
Monitoring that didn't take days to notice unauthorized external traffic would probably be a good start
by queenkjuul 3mo ago
Monitoring that didn't take days to notice unauthorized external traffic would probably be a good start
- Arnt 3mo agoI see. I had the impression that "days" is already good as these things go, "months" being more common.
- queenkjuul 3mo agoMonths to recognize traffic escaping a sandbox you set up yourself?
- Arnt 3mo agoNo, unauthorised traffic across a firewall in general. This involved some lateral movement, ie. traffic didn't just cross the intended sandbox border. Is that kind of thing simpler to detect than an intrusion?
- queenkjuul 2mo agoThe lateral movement was outside OAI's network. The security sandbox should have had an offline package cache and a strict internet whitelist. Detecting unauthorized traffic seems like one of the highest priorities of designing a security sandbox.