Re:Target Hackers Broke in via HVAC Company
by jessaustin on Wednesday February 05, 2014 @04:40PM
(#7187003)
It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Defense at the perimeter only is flawed, especially when the perimeter is the only thing protecting cash registers that update with unsigned firmware. One wouldn't connect such a client directly to the internet, so neither should one connect it directly to a network shared by millions of devices at 1700 stores.
[ Parent
| on HN ]
Re:Target Hackers Broke in via HVAC Company
by bdunbar on Thursday February 06, 2014 @12:03AM
(#7188821)
> It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself.
Exactly this.
I realized this a few years ago, at a previous employer. We had _excellent_ security at the firewall boundary.
Inside the network gave me cause for concern. Once could plug into any port, in any building, get an IP address and ping anything on our network.
And how good was site security at a given location? Who knew, really.
When your server's security depends on J. Random Employee not allowing tail-gaters at the back door ... you got problems.