Re:Ubiquiti vs. Krebs
by InTheArena on Thursday March 31, 2022 @10:12AM
(#30867424)
It's almost impossible to prevent a trusted insider attack. It is possible to quickly identify and shut down a insider. I think the second is a bigger issue - they did (obv) identify the attacker - but they had the FBI involved at that point.
[ Parent
| on HN ]
Good policy will prevent you from assigning the person responsible for the breach to the team to investigate themselves, I think the FBI learned that the hard way.
Ubiquiti did not have good security policy as stated in the hacker news post from 3 months ago (cred open to many people etc).
While it’s impossible to completely prevent this, best practices were not followed.
Re:Ubiquiti vs. Krebs
by GekkePrutser on Thursday March 31, 2022 @11:08AM
(#30868048)
No it's virtually impossible to prevent it. It's very important to detect it though and to have a playbook in place on how to deal with it.