We asked industry professionals about the moments in their security careers that horrified or shocked them so much, they didn't know whether to laugh or cry. Read the full stories here: http://tripwire.me/2pxJlpA

1. ITSECURITYITSECURITY
HORROR
STORIES
WHEREFOUNDATIONALCONTROLSWENT
OVERLOOKED
WHEREFOUNDATIONALCONTROLSWENT
OVERLOOKED

2. or
Weaskedindustryprofessionalsabout
themomentsintheirsecuritycareers
thathorrifiedorshockedthemso
much,theydidn'tknowwhetherto...
horrified shocked

3. Thisparticularorganizationpaid
theiremployeesbonusesbased
ontheamountofmoneythey
savedfromtheirbudgets!
Therefore,insteadoftryingto
picksecuritysolutionsthat
helpedbettertheirsecurity
posture,theychosetodothe
minimumrequiredtobe
compliant...
-IRFAHN KHIMJI
@THEREALKHIMJI

4. ...Theypitchedagreat
storytotheexecutives
tosaythatbeing
compliantwiththePCI
standardmadethem
secure,buttheywere
horriblymistaken.
-IRFAHN KHIMJI
@THEREALKHIMJI

5. Wewereinastaffmeetingwhenoneoftheengineers
receivedacallfromourISPtonotifyaboutsuspicioustraffic.
Theirmonitoringteamobservedthataserveronour
environmentwascommunicatingwithaknownmalicious
command-and-controlserverinanothercountry...
-KEIRSTEN BRAGER
@HIDDENCYBFIGURE

6. ...Theincidentresponseplan:pull
theserveroffthenetwork.Makes
sense,right?Therewasonesmall
problem:noonecouldfindtheserver.
-KEIRSTEN BRAGER
@HIDDENCYBFIGURE

7. Iwasdoingaphysicalsecurity
assessmentforthiscompany,
andoneofthetaskswas
reviewingtheserverroom.The
'serverroom'wasjustanother
officethathappenedtocontaina
serverrackinarepurposedcloset
withdoorsremoved,whichwas
opentoallemployees‒
unfortunately,thisistypicaland
notwhatstoodouttome...
-Zoë Rose
@5683MONKEY
Come in, WE’RE
OPEN

8. ...Therealdishearteningpart
wastherewasawindow
directlybesidetheserverrack‒
noscreenorbars‒onthe
groundlevel...Ifyouwanted,
youcoulddoallyoursysadmin
taskswhilesittingoutsidefora
picnic.Or,ifyouwanted,you
couldwalkbythebuilding,
pluginarandomUSB,andno
onewouldbethewiser.-Zoë Rose
@5683MONKEY

9. IamremindedofthetimeIgainedaccess
toabuilding,connectedontotheir
network,andfound'CreditCardsFront
andBack.pdf.'Thiswas,ofcourse,acopy
oftheirstaffcreditcards.
-RICHARD DE VERE
@RFDEVERE

10. An'IT'staffmembercametoan
officewearingajacketthatsaid
ITonthebackandrequested
accesstotheservercloset.The
frontdeskpersonnelasked
themtosigninbutallowed
themtoenterwithoutanID
check.Roughlyanhourlater,
the'IT'persondepartedthe
officeandthingsstartedtogo
verybadly...
-HUDSON HARRIS
@LEGALLEVITY

11. ...Inshort,theofficeservers
gothitwithransomwareandall
operationsceased.Inthepost-
mortem,theindividualclaiming
tobepartoftheITstaffwrote
'hacker'onthesign-insheetand
wasactuallywearingashirtthat
saidhacker‒allveryobvious
andplain.
-HUDSON HARRIS
@LEGALLEVITY

12. Iwastaskedbyaclienttopentestawebapp,which
waspresentedtomeasasimpleloginform.Theclient
didnotprovideanylogincredentials.So,themain
goalwastotryandgainaccesstothesystem.
Ontheloginpage,therewasanemailaddress.Itread
somethinglike,'Ifyouhaveanyissuesloggingin,
emailthesiteadministratorjohn@example.com'...
-RYAN DEWHURST
@ethicalhack3r

13. ...Myfirstthoughtwas,'Does
thisJohnfellowhaveanaccount
onthisapplication?'So,Itried
username=john@example.com,
password=password.Andloand
behold,itworked!Theclienthad
paidforseveraldaysandwas
quiteembarrassedthatitonly
tookmeabout5minutestogain
accesstotheirsystem.
-RYAN DEWHURST
@ethicalhack3r

14. Ihadtheunsavorytaskoflettingan
employeego.Unfortunately,this
personwasoneofoursysadmins,so
itwasabitofaprocessgetting
credentialschanged,etc.Afterallthe
appropriatechangesweremade,Isat
thispersondownandbrokethenews.
Iaskedthemtopacktheirthings,turn
intheirkeysandleave...
-JIM NITTERUER
@JNITTERUER

15. ...Whiletheindividualwaspacking,Isteppedout
momentarilytousethebathroom.Igotcornered
talkingtosomeoneinthehallandreturned15minutes
laterexpectingtheformeremployeetobepackedand
readytogo.Instead,Ifoundhimconnectinghis
personallaptoptothenetworkandattemptingto
downloadhisarchivedworkfiles!
-JIM NITTERUER
@JNITTERUER

16. Thatmomentwhenyouareworkingforamassivemanaged
servicescompanyandyouareabouttouploadadebugfileto
thevendorofyourticketingsystemandfindoutyoucansee
alltheirclients'SFTPfoldersontheirdropsite.Globalbanks,
pharmaceuticalcompaniesanddefensecontractorsallhave
foldersyoucanaccess.Youquicklylookinyourownfolderto
seewhattheseothercompaniescanseeaboutyour
organization...
-EAN MEYER
@EANMEYER

17. ...Notonlyhaveprofessionalservicesdroppedallyourarchitecturaldesigns,passwordsandCMDBdatatherebutalsoleftthelastonsiteprofessionalservicesrepresentative'sunlockedPSTfilethere‒itcontainsatreasuretroveofpasswords,usernames,businesscommunicationsandenoughcompanycultureinformationtomakeasocialengineerfaint.
-EAN MEYER
@EANMEYER

18. Whilstworkingforalargeenergy
companyintheUK,oneofmyroles
inInformationSecuritywastovisit
offshoresitesandconducttechnical
securityauditsbasedonISO27001.
Inoneofmyvisits,Iwenttoa
brand-newfacilityofoneofour
suppliers[toconductareview].As
partoftheaudit,Ireviewedsix
backupgeneratorsandhowoften
theyweretested,etc...
-PAUL PJ NORRIS
@PJNORRIS

19. ...Iwasshockedtoseethattwo
ofthesixgeneratorswererunning
atthetimeofmyvisit.Initially,I
wasinformedtheywerebeing
testedatthatmomentintime,but
subsequently,Ilearntthatthe
entiresitehadnotbeensupplied
commercialpowerfromthelocal
grid,soithadbeenrunningon
generatorpowerforthepastnine
months!
-PAUL PJ NORRIS
@PJNORRIS

20. Oneofmyfirsttasksatthis
companywastosetupaESXi
server.Ideployedtheserver
andhadnoissuesformonths.
Then,onedayIranaportscan
againstourpublicIPaddress
spaceandnoticedsomethinga
bitodd:awebsitebeinghosted
onapublicIPthatwasn't
supposedtobeused...
-TRAVIS SMITH
@MRTRAV

21. ...Itturnsoutthatbeforemytenure,astagingwebserverhadbeensetupthathadaNATbetweenapublicIPandtheinternalIPIwasnowusingformyESXiserver.Whentheoriginalstagingserverwasdecommissioned,theNATruleinthefirewallwasneverremoved.IhadanESXiserverpubliclyavailablefromtheInternet.AtfirstIcried,butafterfixingtheissueandsiftingthroughlogsfordays,Ilaughedathowbadthatwas.
-TRAVIS SMITH
@MRTRAV

22. MORALOFTHESTORIES?
Muchofprotectingany
organizationisn'taboutmore
advanceddetectionornewtools,
butaboutconsistentlyapplyingthe
toolswealreadyknowwork.Doing
thebasicsrightisthefoundationof
informationsecurity.
MORALOFTHESTORIES?
-TIM ERLIN
@TERLIN

23. FORTHELATESTSECURITYNEWS,
TRENDSINSIGHTS,VISIT:
TRIPWIRE.COM/BLOG
FORTHELATESTSECURITYNEWS,
TRENDSINSIGHTS,VISIT: