Each port on the network switch should of been MAC bonded and then if someone connected an unauthorized device, it would of shut down the port and thrown an alarm with the offending MAC address, which can then be traced to the device being plugged in. This is exactly how I handle all the switches in all my networks.
Well IT is responsible for all the network equipment and infrastructure so if the data breach occurred because something was incorrectly configured then IT is 100% responsible. If the breach occurred on stationary work computers, that were NOT BYOC, IT is responsible. If the data breach occurred because the network was accessed and that access was not correctly configured, IT is responsible. If a computer enters the network that is not pre-authorized and already vetted, and gains unauthorized access IT is responsible. Basically if a computer is at fault, IT is responsible.
In the home environment is where IoT devices are very dangerous, because I would never expect a home user to have the gear or skill to do these kind of configurations, that is where we need required certifications and marks to show the security is at a decent enough level, X.
Right and that's not what we're arguing, no matter how insecure they are, you have to connect them to your network in the right manor. The firs thing I would do is to provision a VLAN on my network with full port monitoring, then hook up a firewall to monitor that VLAN, then connect those devices and isolate them so they don't and can't talk to the rest of the network. This would take maybe 1 hour, so being to busy, really isn't an excuse.
Common sense would tell even a high school level IT student, to throw the device into an isolated VLAN and attach port monitoring to the port on the switch which the device will talk to, so they can see how the traffic is coming out and if it's safe or not.
There is nothing wrong with IoT devices, as I'm currently producing several such devices myself. The problem comes in how you connect them to your network infrastructure.
Who the hell would put an IoT device in the same VLAN with other network equipment? "Professionals" who cause these massive security issues and effectively shoot themselves in the foot deserve every second of pain and hardship they run into.
It's a multi-state, multi-variable issue and depends what kind of development the developer is doing.
As an example, when I'm doing low ever firmware development, things I would measure as success: 1. Robustness of solution. 2. Efficiency of Code. 3. Preform a LINT / leak scanner and look at that output. 4. Speed of module / driver / support coding. 5. How they handle library and portability in their development. 6. Security and complexity in terms of O and o.
Web Frontend Development: 1. How their work scales across different browsers and resolutions. 2. Engagment, look and feel. 3. Lines of code to implement certain aspects, less (usually) better. 4. Framework engagement, for instance using Angular.JS instead of rolling their own. 5. Knowing / applying stuff like jQuery or knowing not to. 6. How they implement REST services.
If I'm doing Server End work, I'll have a completely different set of requirements, same with desktop frontend, backend and etc....
Developers who speak out against GOTO, show their amateur or assumed armature level or experience. `I had a prof in University who spoke out strongly against it, even going to lengths such as costly loops and costly checks to get around using a simple GOTO, his code was made worse because he refused to use it. If you honestly feel GOTO is an unexceptionable statement in programming, then please write a program in ASM and NEVER use JMP!
If you choose to take a real degree, you should pay more. Engineering degrees cost more then gender studies / feminist degrees because you have to hire specialists and under go hours and hours of lab times, equipment time and consume, generally, resources.
Gender Studies / Feminism degrees just involved saying "patriarchy" over and over and mis-defining sexism and objectification.
We use Windows 10 at work, due to the fact we have to use Visual Studio and Windows 10 is a sorry excuse for an OS, not only does Edge reset itself constantly, Skype locks up, Visual Studio locks up and crashes constantly, the boot time is HORRIBLE, everything is sluggish, the keyboard ghosts and that's just for starters. This morning my computer decided it would reset itself and all of it settings, for no F'ing reason.
My computer doesn't have any viruses and it doesn't have any kind of hardware problem. I've seen this exact behavior now on three completely separate computers that even have different hardware, so it's not a hardware platform problem either, it's typical Microsoft failing to place nice.
If Microsoft didn't corner the market for certain development channels, everyone would switch to either GNU / Linux or MAC, two operating systems that vastly outrank Windows in almost every possible avenue. In fact I feel completely comfortable in saying that GNU/Linux makes Windows seem like a mentally slow inbred cousin of an operating system in comparison. I would pick Gentoo or Ubuntu over Windows 10 in every possible comparison, even for development, and force Visual Studio to run under Wine, which would still be more stable and outperform it running on Windows 10..
I've already been on the phone with Microsoft several times to try and solve these problem we're having and it's pointless, they can't provide any help, they don't understand the problem and they don't have any kind of actual answer that is suitable. Windows 10 is flat out horse shit, the streaming kind.
Take all of those whinny little travelers and reply back: "If you think it's easy keeping computer systems up, running and online for US wide air traffic control, please submit your resume or shutup!"
North America is now entirely ruled unqualified morons. We have Justin, who has proven to be a completely idiot, in Canada, the son of one of the worst Prime-minsters in history and now the US has Trump.
If it was the second hottest then global warming isn't happening, because if the earth is warming up, then it must be the hottest year, game over climate-tards!
You're exactly right, with why I think Trello + Jira would just be near prefect. I like the boards in Jira, but the setup is a little annoying. Even though it's annoying it still is the best tool almost full stop for project management that I've used.
I had paper work letting let through to the end point, I was being nice by talking to them in the first place, which I didn't have to, but I had time to kill.
Except if I wanted to give you a device for a while, but protect all the information on it, I can just ship you a device, I keep the key device and now all my data is protected from you, something passwords are really bad at.
Don't provide any password to a border agent, or really anyone who doesn't need it.
My company is currently in the process of designing a special TPM style product that makes it very near impossible to enter a devices without being the one intended for reception. Well solutions like this do exist, ours is going to be fairly open, cheap and allow it to interface to almost device to which someone can write a low level kernel based driver. With our device, it makes it impossible to access the contents of anything on the device under encryption due to how the data is stored and decrypted. Without access to the exact key which is paired to the device under encryption, you may as well wipe the device because except in exceptional cases, where multiple keys are warranted, there is no other way in the device under encryption.
I'm bringing this up for this exact kind of situation, well traveling you can keep your data fully encrypted, have one of our keys at home, with the data it encrypted being unavailable physically until you arrive home, and you could carry a second key which can decrypt any data marked for use between the two keys or just the data encrypted well traveling, with the only way to view the date, to be in possession of a key physically, think very small USB thumb drive.
If the border needs access, they can get access themselves. You're not stopping them by giving your phone, and you're not stopping them by refusing to give up a password or encryption key, you're simply protecting your right against possible self incrimination, and if the border patrol is actually qualified in the first place to do a job that would be require decryption information on a phone, they should be able to do it regardless of what you put on it. I know that's a ridiculous statement, but it works. You shouldn't have to provide access to your personal data, to anyone. If anyone wants access, they can get access themselves without you.
I even once gave the border an entire database encrypted with our key solution, told them how it was encrypted and that the key for decryption was already sitting at an office in the US, so even if I wanted to get the data, I couldn't, they had no choice but to let me travel. You're not blacking anything by refused to decrypt data or let them into the system. In our case, we're going to the Nth degree and making it a physical problem, where it doesn't matter if you know the password, because it's point to point tied down.
I support anyone who refused to give up access, it's the right thing to do, the access isn't theirs and if it is, they can enter it themselves.
Slashdot Mirror
Each port on the network switch should of been MAC bonded and then if someone connected an unauthorized device, it would of shut down the port and thrown an alarm with the offending MAC address, which can then be traced to the device being plugged in. This is exactly how I handle all the switches in all my networks.
Well IT is responsible for all the network equipment and infrastructure so if the data breach occurred because something was incorrectly configured then IT is 100% responsible. If the breach occurred on stationary work computers, that were NOT BYOC, IT is responsible. If the data breach occurred because the network was accessed and that access was not correctly configured, IT is responsible. If a computer enters the network that is not pre-authorized and already vetted, and gains unauthorized access IT is responsible. Basically if a computer is at fault, IT is responsible.
In the home environment is where IoT devices are very dangerous, because I would never expect a home user to have the gear or skill to do these kind of configurations, that is where we need required certifications and marks to show the security is at a decent enough level, X.
Right and that's not what we're arguing, no matter how insecure they are, you have to connect them to your network in the right manor. The firs thing I would do is to provision a VLAN on my network with full port monitoring, then hook up a firewall to monitor that VLAN, then connect those devices and isolate them so they don't and can't talk to the rest of the network. This would take maybe 1 hour, so being to busy, really isn't an excuse.
Common sense would tell even a high school level IT student, to throw the device into an isolated VLAN and attach port monitoring to the port on the switch which the device will talk to, so they can see how the traffic is coming out and if it's safe or not.
There is nothing wrong with IoT devices, as I'm currently producing several such devices myself. The problem comes in how you connect them to your network infrastructure.
Who the hell would put an IoT device in the same VLAN with other network equipment? "Professionals" who cause these massive security issues and effectively shoot themselves in the foot deserve every second of pain and hardship they run into.
It's a multi-state, multi-variable issue and depends what kind of development the developer is doing.
As an example, when I'm doing low ever firmware development, things I would measure as success:
1. Robustness of solution.
2. Efficiency of Code.
3. Preform a LINT / leak scanner and look at that output.
4. Speed of module / driver / support coding.
5. How they handle library and portability in their development.
6. Security and complexity in terms of O and o.
Web Frontend Development:
1. How their work scales across different browsers and resolutions.
2. Engagment, look and feel.
3. Lines of code to implement certain aspects, less (usually) better.
4. Framework engagement, for instance using Angular.JS instead of rolling their own.
5. Knowing / applying stuff like jQuery or knowing not to.
6. How they implement REST services.
If I'm doing Server End work, I'll have a completely different set of requirements, same with desktop frontend, backend and etc....
Developers who speak out against GOTO, show their amateur or assumed armature level or experience. `I had a prof in University who spoke out strongly against it, even going to lengths such as costly loops and costly checks to get around using a simple GOTO, his code was made worse because he refused to use it. If you honestly feel GOTO is an unexceptionable statement in programming, then please write a program in ASM and NEVER use JMP!
I would never tell a future employer how much I made in the past, they don't need to know for any reason.
If you choose to take a real degree, you should pay more. Engineering degrees cost more then gender studies / feminist degrees because you have to hire specialists and under go hours and hours of lab times, equipment time and consume, generally, resources.
Gender Studies / Feminism degrees just involved saying "patriarchy" over and over and mis-defining sexism and objectification.
Windows 7 was the last decent OS they released.
We use Windows 10 at work, due to the fact we have to use Visual Studio and Windows 10 is a sorry excuse for an OS, not only does Edge reset itself constantly, Skype locks up, Visual Studio locks up and crashes constantly, the boot time is HORRIBLE, everything is sluggish, the keyboard ghosts and that's just for starters. This morning my computer decided it would reset itself and all of it settings, for no F'ing reason.
My computer doesn't have any viruses and it doesn't have any kind of hardware problem. I've seen this exact behavior now on three completely separate computers that even have different hardware, so it's not a hardware platform problem either, it's typical Microsoft failing to place nice.
If Microsoft didn't corner the market for certain development channels, everyone would switch to either GNU / Linux or MAC, two operating systems that vastly outrank Windows in almost every possible avenue. In fact I feel completely comfortable in saying that GNU/Linux makes Windows seem like a mentally slow inbred cousin of an operating system in comparison. I would pick Gentoo or Ubuntu over Windows 10 in every possible comparison, even for development, and force Visual Studio to run under Wine, which would still be more stable and outperform it running on Windows 10..
I've already been on the phone with Microsoft several times to try and solve these problem we're having and it's pointless, they can't provide any help, they don't understand the problem and they don't have any kind of actual answer that is suitable. Windows 10 is flat out horse shit, the streaming kind.
Take all of those whinny little travelers and reply back: "If you think it's easy keeping computer systems up, running and online for US wide air traffic control, please submit your resume or shutup!"
North America is now entirely ruled unqualified morons. We have Justin, who has proven to be a completely idiot, in Canada, the son of one of the worst Prime-minsters in history and now the US has Trump.
If it was the second hottest then global warming isn't happening, because if the earth is warming up, then it must be the hottest year, game over climate-tards!
COMPLETELY JOKING
You're exactly right, with why I think Trello + Jira would just be near prefect. I like the boards in Jira, but the setup is a little annoying. Even though it's annoying it still is the best tool almost full stop for project management that I've used.
If they could build Trello into Jira, they would improve the best project management platform on the market.
Just use C, the tools are great and it leaves the programmers in-charge.
Bash still works perfectly fine, so all real IT guys and teams will be fine.
It's horrible, has a ton of bugs and doesn't properly support JavaScript or CSS, we had to end up blocking it on my companies website just to be safe.
True but if the device which can unlock it, is sitting in another place, even country, they can't force that.
I had paper work letting let through to the end point, I was being nice by talking to them in the first place, which I didn't have to, but I had time to kill.
Except if I wanted to give you a device for a while, but protect all the information on it, I can just ship you a device, I keep the key device and now all my data is protected from you, something passwords are really bad at.
Of course :P but I was just ignoring that angle.
Don't provide any password to a border agent, or really anyone who doesn't need it.
My company is currently in the process of designing a special TPM style product that makes it very near impossible to enter a devices without being the one intended for reception. Well solutions like this do exist, ours is going to be fairly open, cheap and allow it to interface to almost device to which someone can write a low level kernel based driver. With our device, it makes it impossible to access the contents of anything on the device under encryption due to how the data is stored and decrypted. Without access to the exact key which is paired to the device under encryption, you may as well wipe the device because except in exceptional cases, where multiple keys are warranted, there is no other way in the device under encryption.
I'm bringing this up for this exact kind of situation, well traveling you can keep your data fully encrypted, have one of our keys at home, with the data it encrypted being unavailable physically until you arrive home, and you could carry a second key which can decrypt any data marked for use between the two keys or just the data encrypted well traveling, with the only way to view the date, to be in possession of a key physically, think very small USB thumb drive.
If the border needs access, they can get access themselves. You're not stopping them by giving your phone, and you're not stopping them by refusing to give up a password or encryption key, you're simply protecting your right against possible self incrimination, and if the border patrol is actually qualified in the first place to do a job that would be require decryption information on a phone, they should be able to do it regardless of what you put on it. I know that's a ridiculous statement, but it works. You shouldn't have to provide access to your personal data, to anyone. If anyone wants access, they can get access themselves without you.
I even once gave the border an entire database encrypted with our key solution, told them how it was encrypted and that the key for decryption was already sitting at an office in the US, so even if I wanted to get the data, I couldn't, they had no choice but to let me travel. You're not blacking anything by refused to decrypt data or let them into the system. In our case, we're going to the Nth degree and making it a physical problem, where it doesn't matter if you know the password, because it's point to point tied down.
I support anyone who refused to give up access, it's the right thing to do, the access isn't theirs and if it is, they can enter it themselves.