• 0 Posts
  • 7 Comments
Joined 1 year ago
cake
Cake day: July 5th, 2023

help-circle
  • DesertCreosote@lemm.eetoMemes@lemmy.mlGoogle “search”
    link
    fedilink
    arrow-up
    7
    arrow-down
    1
    ·
    11 months ago

    Can’t speak for the person you’re replying to, but I’m a security engineer and stuff still makes its way to me that you would think would get filtered out by others (and isn’t my job to fix). It just takes the right person thinking “this is obviously a problem with $system, let’s just send it straight over to them so they can fix it quickly!” And then we get the fun job of proving it’s not us and has no relation to us.

    We got a ticket today for packet loss between two systems, neither of which have any of our tools on them…




  • Depending on where you work, your employer may be able to take that personal device you’re using for work in the event of a lawsuit against the company (where they need to retain anything that may be relevant to discovery), or in the event of a security incident (where they may need it for forensics).

    I work in information security, and I practice strict isolation for that exact reason. Two laptops, two phones, because if anything ever happens they can and will take devices for analysis or evidence. If you are using an issued device, they’ll assign you a new one; if it’s a personal device you’ll get it back when they’re done with it, which could take years.

    Edited to add this is dependent on your employment contract, but it’s better to be safe than sorry. Cover your camera and use your work computer.


  • I’m a security engineer, and encryption is great, but can be bypassed. Relying on encryption assumes it was implemented properly, that the system was shut down properly so all keys were flushed correctly, and the encryption algorithm doesn’t have weaknesses.

    Generally if somebody dedicated enough can acquire physical access to a system, they can probably find a way into it given the right resources. Did that happen here? Probably not. Could it have? Absolutely. That’s why most enterprises or government hard drives are shredded rather than just relying on them being wiped or encrypted.

    Encryption is part of the solution, but it’s not automatically the complete solution.