Hacker News Reader

Wow, this is sobering.

I've certainly heard it said that if you're a big tech company, you are already infiltrated by state-sponsored hackers. But since I've never seen one of these red-team reports, this synopsis provides a lot of color on how people can get around inside the network, once they get in, that I wasn't aware of (obviously I don't work in opsec).

Too bad for Palantir that this got leaked, but perhaps it can be instructive for many of us.

View on HN

The truth is that when reputable information security specialists are engaged to perform a no holds barred internal network penetration test or red teaming exercise for a client, they will gain full administrative access of the network in more than 9 out of 10 cases. There are well known and documented techniques for escalating privileges and traversing through a network. This is just the reality if you operate a typical Windows corporate network of a sufficient size.

In the past, companies mostly just accepted this risk and focused on protecting their network perimeter. Over time, this attitude has shifted and organisations now recognise the insider threat (e.g. a rogue employee/contractor or an external attacker who has already breached the perimeter).

Reply on news.ycombinator.com