Gitlab phished its own work-from-home staff, and 1 in 5 fell for it

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by owenmarshall on Saturday May 23, 2020 @10:30AM (#23283220)

Most companies I’ve encountered have moved towards split-tunneled VPNs so an employee clicking on a phish page would traverse the employees gateway, not corporates.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by tbyehl on Saturday May 23, 2020 @12:31PM (#23284277)

My experience is the opposite: Part of the justification for moving away from standards-based VPNs is to prevent split-tunneling.

My present employer's VPN client goes a step further and mangles the routing table to deny access to my own LAN while connected.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by owenmarshall on Saturday May 23, 2020 @04:16PM (#23285999)

I can’t decide if I hate that more or less than what I’ve seen: client-side blocking of DNS resolution and driving all queries through Cisco Umbrella or friends.

I guess they both suck pretty hard.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by 411111111111111 on Saturday May 23, 2020 @01:44PM (#23284867)

interesting, i heard that some employers did set the default route to go through their vpn, havent had that experience myself either though.

it was always only the 10.0.0.0/8 and some /24 ranges from 192.168.0.0/16 at my current job

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by o-__-o on Saturday May 23, 2020 @05:55PM (#23286878)

liberty mutual, the largest insurance provider, is in the process of moving from default route on the vpn to no vpn at all and zero trust networks for their apps.

[ Parent | on HN ]