Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by gauravphoenix | Hacker News Reader

Parent Full thread

gauravphoenix·

There could be many vectors including the compromise of the build server.

That Jenkins plugin you haven't updated in years. Or that maven package no one knows about.

Third party risk management is unfortunately not well funded cyber security vertical.

View on HN

Solarwinds is not your average software company. Look at their customer list. They would have had ISO certifications and independent 3rd party audits done a billion times. Those type of companies don't even speak to you if you don't have those credentials.

You think you are supplying software to all the armed forces branches and "forgot" to update a Jenkins plugin?

Yes, absolutely. Oh, the amount of outdated software that your average corp runs is mind blowing. Not only that, but if you have a tight IT department, the amount of shadow IT that happens because of the too onerous processes put in place by IT will leave so much infrastructure that is critical but not managed correctly.

As a security professional, getting people to upgrade simple software is difficult enough, upgrading critical infrastructure used 24/7 by the development team... forget about it.

Corporation probably doesn’t even know, IT management is all outsourced

One conclusion is that process and certification is a waste of time and get you stuck with the same crappy software forever.

>You think you are supplying software to all the armed forces branches and "forgot" to update a Jenkins plugin?

yeah. Just now I am reading that their FTP servers had such a weak password that it allowed the pentester to upload/replace any binary back in 2019

Reply on news.ycombinator.com