Cus Productions

The always-excellent Paul Asadoorian of the eponymous ‘PaulDotCom‘ website took a SANS course on “Cutting-Edge Hacking Techniques”. He summarises a lot of the basics over at GNUCITIZEN. I especially like:

There is no “inside” - Treat your network as if it is always exposed directly to the Internet, because essentially, it is (see points above). For example, use secure protocols (SSH, Radmin) on the “inside” of your network.

I’ve been seeing far too many examples of hard shells but soft chewy centres at various companies. I’ve said to network admins to assume that at some stage the network will be compromised - either internally or externally. What do you do to minimise the amount of data that will be accessible?

Of course, the exposure of company systems to the internet is something that is exploding thanks to Web Services. For years we spent time trying to stop people from accessing corporate data and processes, but thanks to Web Services we’re doing exactly that