Re:CISA Director on Log4j Vulnerability
by cscurmudgeon on Sunday December 12, 2021 @01:38AM
(#29527628)
Its the weekend! Security can wait. /s
[ Parent
| on HN ]
For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)
I recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?
In some cases I know (with smaller orgs) it happens because someone put a requirement in that they need to react to incidents with the service within X hours, but didn't provide the budget for the employees or external service needed to have that 24/7.
Re:CISA Director on Log4j Vulnerability
by lkschubert8 on Sunday December 12, 2021 @08:58AM
(#29529640)
I've heard of similar things being done for ADA compliance. Something about requiring a phone line to be up at all the same times as the website so instead of a 24/7 call center you just turn the site off.