Re:80% of orgs that paid the ransom were hit again
by bluGill on Friday June 18, 2021 @10:25PM
(#27557208)
Notice the previous comment about developers not allowed to be admin of their own machines? On computers with a good security model developers don't need to be admin of their own machines, but that wasn't thought of.
Re:80% of orgs that paid the ransom were hit again
by mcny on Friday June 18, 2021 @11:12PM
(#27557402)
I don’t get the point of not allowing administrator to the local machine to employees. The local machine is practically a throwaway in my opinion. Why should we care about it? The shared folder is much more vital to the business.
Re:80% of orgs that paid the ransom were hit again
by curryst on Saturday June 19, 2021 @09:26PM
(#27566194)
It makes some attacks a lot easier. You usually need admin access to install a rootkit so your virus can re-install itself. You also get full control over the network stack, which makes it trivial to MitM traffic. Admin access will let you disable whatever security monitoring tools are installed so you can stay undetected for longer.
Locking down admin access is less about protecting the local machine and more about preventing the laptop from becoming a jumping off point into more important pieces of infrastructure. It's by no means fool proof, but it adds another security feature that has to be countered.
I don't know whether it's worth the trouble it creates, but I don't think it's totally without justification.
Re:80% of orgs that paid the ransom were hit again
by ryanmcbride on Friday June 18, 2021 @11:49PM
(#27557577)
Yeah anytime a job locks admin access to a local machine I assume their network security is full of holes, and I'm usually right about that assumption.
Re:80% of orgs that paid the ransom were hit again
by ryanmcbride on Friday June 18, 2021 @06:54PM
(#27555902)
that's what I'm saying. Just training isn't enough the system has to be hardened.
No. It never takes only one employ clicking a bad link. It takes that click, plus a browser/email/os system that allow for random code to executed. It take an IT department that has allowed individual non-IT employees to use computers with elevated privileges. It requires a management structure that has failed to invest in proper off-site/cold backups. It requires an organization that doesn't have a proper business continuity plan.
And at the top of the incompetency pyramid, it requires a vendor that sells an email system that allows evil email messages to somehow infect entire operating systems. Want your email to connect to your office suite? Sure. Want to install random software based on clicked links? Sure thing. Want to update your firewall, install a new browsers and simultaneously backup all your encryption keys to a random server in the far east? Why not! Anything to make your operating system experience seamless.