The article doesn't explicitly go into it, but I get the impression this could be greatly improved by making those utilities public instead of private and requiring certain standards rather than encouraging them.
every month or so i get reminded of how many telco customers here have default passwords for their pppoe authentication (for dsl) and email accounts. it's scary.
I’m too drunk to read the whole thing, but I have an anecdote that is related.
Years and years ago one of my customers was a city. They had SCADA systems to control and monitor the city water. Originally there was no way to access the Internet from the control machines and no way to access those machines from the Internet.
Well, they got a new boss at the water department and he wants to check it from home. He’d been told that’s a bad idea repeatedly. Eventually my boss got some folks at the city to sign a document saying we don’t recommend it and they accept the risks and I get him remote access.
Time moves on several months and suddenly half the city has no water. Anyone care to guess why? Anyone care to guess who the city tried to blame? Because that person and the MSP they worked for would have been fucked if not for a nice waiver showing that we said this would happen.
Nope. No consequences at all. He was around for a while after that, same position. A quick glance at LinkedIn shows he owns/runs a hotdog joint now. That’s not something I would have guessed.
For all the measures companies take to secure everything from unauthorized access via breaches in security, there is *NO * greater threat to their system than the intended end-user.
Who can be dumb, lazy, complacent, or simply doesn’t give a shit. Usually those last two in my experience.
I’ve seen a setup that requires multiple pass codes and keys to get from any door to the server room, with reminders that personal devices are NEVER to be used with anything inside all along the way, and some chucklefuck sticks a flash drive with his music in the only pc in the room “so I can jam while I work, you know how it is, nobody will know”
My experience is: If you don’t want x to happen with computer systems, make it physically impossible. Cut the internal USB cables or super glue them shut.
I actually have worked in places where the company straight up took a screwdriver and physically broke every single usb port.
Also had to use a non-networked laptop where all the i/o ports were hot glued to keep whoever works on it from putting anything on it, since it was for a specific purpose.
Add comment