The Sony hack how-to
They got an administrator's login credentials.
Makes me wonder if they were using two-factor authentication for their admins, and if not, why not.
(For those unfamiliar, two-factor authentication is what World of Warcraft uses. It uses both a password AND a time-sensitive dongle code to provide access.)
Makes me wonder if they were using two-factor authentication for their admins, and if not, why not.
(For those unfamiliar, two-factor authentication is what World of Warcraft uses. It uses both a password AND a time-sensitive dongle code to provide access.)
Add Comment
All Comments Hide marked as read Mark all as read
- 2Posted by $ MikeMarotta 11 years, 2 months agoThe free market impels toward excellence. You cite "World of Warcraft" and that is acceptable. I also used code boxes for a project at Bell Telephone; and I was given one by the Union Bank of Switzerland. Sony's root problem was complacency. A couple of weeks ago, we heard Brian Krebs speak and we bought copies of his new book. He said that the problem is not the lack of tools. Heck, corporations pay a million dollars for a full set of tools. The problem is that they reduce their IT Security staff, leaving no one to actually engage the tools.| Mark as read | Best of... | Permalink
- 1Posted by $ blarman 11 years, 2 months agoYup. Security is one of those things that no one pays attention to until the fire has burned down the building. Most companies aren't willing to impose the security necessary on their business units in order to protect them - until something like this happens.| Mark as read | Parent | Best of... | Permalink
-
-
- 1Posted by $ root1657 11 years, 2 months agoAs a computer security guy, this has me thinking.... maybe it's time for a shift in the computer security model.... maybe it's time to limit the power of admin accounts. By this I mean bringing in the idea of 'least privilege' and making it so that somehow the admin cant see the contents of user data. Sure, I know you have a bunch of files, and what the properties of the files are, but should I be able to access the data in the files? It would be a monster to implement, and to catch the work arounds (create new user, move files, you get what I mean) but it might be time to figure it out.| Mark as read | Best of... | Permalink