News for hackers. Stuff that matters.

A comment on CircleCI says hackers stole encryption keys and customers’ source code. Parent comment

Re:CircleCI says hackers stole encryption keys and customers... by debarshri on Sunday January 15, 2023 @04:47AM (#34388162)
Stopping employee from accessing anything and everything in production impacts productivity and engineer often do not want to work in that kind of environment.
[ Parent | on HN ]
Re:CircleCI says hackers stole encryption keys and customers... by AYBABTME on Sunday January 15, 2023 @04:48AM (#34388171)
It's also not possible, by definition someone needs some access. Compromise enough of those people and there's no way around it.
[ Parent | on HN ]
Re:CircleCI says hackers stole encryption keys and customers... by debarshri on Sunday January 15, 2023 @05:00AM (#34388215)
Exactly. Only thing you can do is make a drill where you assume everything is hacked and audit access daily, weekly and monthly.
[ Parent | on HN ]
Re:CircleCI says hackers stole encryption keys and customers... by wepzen on Sunday January 22, 2023 @04:05AM (#34475635)
Implementing a zero-trust architecture with a trust-score system for users and a dynamic policy for accessing resources can help to limit potential damage in the event of a security incident. But I agree that the balance between protecting against attacks and maintaining productivity can be delicate.
[ Parent | on HN ]