<story><title>SolarWind, enough with the password already</title><url>https://gru.gq/2021/02/28/solarwind-enough-with-the-password-already/</url></story><parent_chain><item><author>slt2021</author><text>care to add examples? has there ever been a case when state actor sent a rogue employee and succeeded?
because in serious organizations there are robust defenses even against potentially rogue employees</text></item><item><author>qbasic_forever</author><text>I do think a lot of folks are missing the main point that no matter what security theater is in place, a state actor with enough motivation is going to breach it.  They&amp;#x27;re not going to send someone after the password protected parts, they&amp;#x27;re going to send your recruiter the most irresistible candidate--the perfect background, right out of your favorite school and with expertise in exactly your tech stack.  You&amp;#x27;ll get pages and pages of glowing recommendations from people inside and around the industry.  They&amp;#x27;ll ace your interview loops, be loved by all your engineers and managers, and they won&amp;#x27;t bat an eye at the lowball first offer you give them.  They&amp;#x27;ll move up the corporate ranks with ease and be everyone&amp;#x27;s friend... and then the best security in the world doesn&amp;#x27;t matter one bit.</text></item></parent_chain><comment><author>qbasic_forever</author><text>It is _far_ more common than you think.  A few years after I started at MS this guy was caught: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theatlantic.com&amp;#x2F;international&amp;#x2F;archive&amp;#x2F;2010&amp;#x2F;07&amp;#x2F;who-was-the-12th-russian-spy-at-microsoft&amp;#x2F;344876&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theatlantic.com&amp;#x2F;international&amp;#x2F;archive&amp;#x2F;2010&amp;#x2F;07&amp;#x2F;wh...&lt;/a&gt;  I knew a lot of folks internally that worked with him, knew him, etc. and had _no idea_ he was a spy or agent.  He was the model of a perfect employee or hire for MS at the time.</text></comment>
<story><title>SolarWind, enough with the password already</title><url>https://gru.gq/2021/02/28/solarwind-enough-with-the-password-already/</url></story><parent_chain><item><author>slt2021</author><text>care to add examples? has there ever been a case when state actor sent a rogue employee and succeeded?
because in serious organizations there are robust defenses even against potentially rogue employees</text></item><item><author>qbasic_forever</author><text>I do think a lot of folks are missing the main point that no matter what security theater is in place, a state actor with enough motivation is going to breach it.  They&amp;#x27;re not going to send someone after the password protected parts, they&amp;#x27;re going to send your recruiter the most irresistible candidate--the perfect background, right out of your favorite school and with expertise in exactly your tech stack.  You&amp;#x27;ll get pages and pages of glowing recommendations from people inside and around the industry.  They&amp;#x27;ll ace your interview loops, be loved by all your engineers and managers, and they won&amp;#x27;t bat an eye at the lowball first offer you give them.  They&amp;#x27;ll move up the corporate ranks with ease and be everyone&amp;#x27;s friend... and then the best security in the world doesn&amp;#x27;t matter one bit.</text></item></parent_chain><comment><author>freeone3000</author><text>Stuxnet is the one that comes to mind first, where a Polish mole was able to be hired at an Iranian nuclear enrichment facility.</text></comment>