Hacker News Reader

You never know who's swimming naked until the tide goes out.

Would be great if every organization conducted targeted attacks in order to probe the reliability of their assumed safeguards. If your system hasn't been tested by someone who has a real incentive to break it, you have no idea if it is really as secure as you think it is.

View on HN

We do this. Every place I have worked at I've had the senior admin explain and show the backup plans for servers and desktops and demonstrate various restore requests. I have caught a few with their pants down.

Another important thing is fine granular permissions on network shares.

We have our own pen testing team in addition to the 3rd parties who also do it. There’s a big DR test this weekend for our 2 largest data centers as well to make sure backups and fail overs happen. Plus multiple networks for different products that’s completely different from the regular employee network. You even have to sign in if you plug into our Ethernet.

Penetration tests are a huge deal right now. Many companies outsource it to security agencies who then perform the pen tests and report results.

Reply on news.ycombinator.com