Typical points of failure for requirement 1.4?
It's kind of a binary thing.
Either you've done this or you haven't.
And if you've done it,
then even if they are sort of minor areas of noncompliance,
they're relatively easy to hammer into shape.
And if you haven't, then you've just got to do it.
And so is that the same really for businesses as
usual for your second assessment,
when the organization either does it or it doesn't do it?
Right.
I mean baring, again,
if they've done some sort of central management to deploy the right
kind of configurations or they have the sort of knack and policy
adherence testing at connection point,
unless somehow that's come undone in the intervening period,
yeah, I mean you've either got it or you don't.
Okay.
Do you know if this was a cause of compromise?
I've not heard of this being a cause of compromise anywhere.
I've not either.
Yeah, okay.
So it's not one that's liable to let the bad guy in.
We know it's a way the bad guy come in.
Right.
I guess I'm aware of at least some pen testing scenarios
where the attack had some social engineering kind of quality
of targeting the administrator.
Something,
I think I heard a Kevin Mitnick talk where they sent some
cool keyboards to a bunch of the IT people.
You know, hey, here's this promotional like cool gaming keyboard or whatever,
and they all plugged them in and passed them around,
but somebody had, you know,
it was like a soldered Arduino device or something like that
into it that then created some tunnel back out,
right?
And then they could hop in through the administrator workstation.
So, am I aware of actual bad guy attacks doing this?
No.
Am I aware of simulated situations?
Yes.
And it wasn't originally, from my memory,
it wasn't in the first version of DSS, was it?
No, it came along somewhere in the, I think, version 2.
Yeah.
And I think that was after the worms came out, where people went oh, yeah.
And we have to remember, again, DSS is 12 years old.
Twelve years ago, Windows didn't have the firewall for free.
No, it didn't.
There was no firewall in Windows,
so that was part of the reason for putting it in.