Re:Robinhood announces data security incident
by sofixa on Tuesday November 09, 2021 @06:50AM
(#29160425)
Zero trust has been gaining more and more popularity over the traditional hiding behind a VPN and trusting everything behind it. A VPN, if there's one ( it's still useful and avoids unauthenticated exploits on software), should be the first line of defence.
Re:Robinhood announces data security incident
by wil421 on Monday November 08, 2021 @07:34PM
(#29156234)
Bingo. The company I work for even gives certain locales, that are prone to IP theft, VDI only access to company systems. They are given a laptop with nothing on it except tools to access the VPN and VDI.
Re:Robinhood announces data security incident
by niros_valtos on Tuesday November 09, 2021 @07:12AM
(#29160603)
When security impacts productivity it becomes a difficult battle. Zero trust tries to solve the VPN requirement, but as we all know, the devil is in the implementation details…
Especially for remote work - any critical or internal infra should be behind a company-operated VPN, with the VPN-access gated by MFA.
It's obviously not foolproof because the more SaaS you add, the more vulnerable you are, especially because security in HN-land is something you only worry about after-the-fact because it's not MVP or quick to market. But asking for more personal info is perhaps the worst possible conclusion you could take from this.
At some point you have to stop asking your users to take responsibility for your own shoddy security.