Re:SolarWinds CEO blames intern for password leak
by camjohnson26 on Saturday February 27, 2021 @05:56PM
(#26288944)
With all due respect to your experience in the industry, if knowing that an intern’s password is solarwinds123 is enough for an attacker to sign and release an unauthorized binary and publish it to hundreds of customers, then that’s an operational problem that the CEO is ultimately responsible for.
Re:SolarWinds CEO blames intern for password leak
by lawnchair_larry on Saturday February 27, 2021 @08:47PM
(#26289934)
Well, nothing like that even happened, so why are we talking about it? solarwinds123 was a password for a public ftp server. It did not let anyone sign anything and it didn’t push updates out. It isn’t even related to the solarwinds breach.
Re:SolarWinds CEO blames intern for password leak
by camjohnson26 on Saturday February 27, 2021 @10:25PM
(#26290414)
That’s the reason they’re having the hearing, the point is that the CEO is bringing this up and blaming an intern for the massive breach when it’s pretty clearly either a red herring or a complete lapse in security.
It is often the case after these breaches that HNers start assigning blame in ways that indicate their lack of practical experience in the security world. After 20 years working in security, from startups to fortune 500s, including the most well funded security teams in the world, EVERYONE has stupid password problems in some corners of their company. The password leak was absolutely not the CEOs mistake.