jphamlore t1_iui6s0i wrote on October 31, 2022 at 2:58 PM

It's late 2022 and still considered perfectly acceptable that clicking on one link on the web can enable anyone to take over your computer, and from there, the organization's network.

Who could have possibly guessed this would become a massive problem.

And let's not mention how apparently at one point one could randomly leave a USB flash drive lying in the parking lot, and plenty of idiots would plug it in to their computers.

BldGlch t1_iui8vh6 wrote on October 31, 2022 at 3:13 PM

"at one point" - you can still do that and they will still do that

tuscanspeed t1_iuj86v2 wrote on October 31, 2022 at 7:08 PM

Yes, it's a top line item for a security testing firm.

Good security standards and practices are known. A good posture here puts you in good shape to easily circumvent and shutdown a direct attempt on someone gaining access.

That said, have you looked and what makes a secure password now?

"Hey! How do we keep our private data both secure and private?!"
"Let's copy it up to a cloud storage service!"

n3ws4cc t1_iuip691 wrote on October 31, 2022 at 5:02 PM

Get pc's that have no accessible ports with a locked down OS without browsers for core systems and a second, separate network for phones etc. That should fix most human errors then no?

DIBE25 t1_iuisoxd wrote on October 31, 2022 at 5:25 PM

yes but Bethany from accounting needs to run an app her son grabbed from a Chinese website that copies her bookmarks from her computer at home and it needs to be run from a usb key and it needs administrator privileges

I'm exaggerating but until technological literacy is as common as linguistical literacy you're going to have unpredictable scenarios because a ton of exploits rely on human engineering (can't remember the proper term sorry) and not exclusively on the use of exploits in the software (which also boils down to human error)

stewsters t1_iuizd00 wrote on October 31, 2022 at 6:09 PM

Yes, it can be done. There is a lot of useful information on the internet though.

As someone who has tried to program in an environment where you cannot download IDEs without an admin's intervention, access maven central, or just execute code you wrote, holy shit do I not want to live in that world though.