• 0 Posts
  • 39 Comments
Joined 6 months ago
cake
Cake day: May 19th, 2024

help-circle
  • It sounds like you’re getting into the keeping it running phase.

    First, going back to your previous comment, self-hosting email is difficult. It’s not hard for a small provider to end up blacklisted and you’re probably kind of just done at that point and it will feel very unfair. I get that it’s a fun set of technical challenges, but you couldn’t pay me enough to help someone self-host email.

    Second, guessing, but it sounds like you may be trying to expose your services directly and doing a lot to make that work which goes against what most would recommend for hosting your own services. Big companies don’t expose their intranet like that, follow their example. Almost every guide or system is going to warn against that. If you’re going to host more than one thing, highly recommend focusing on minimizing entry points and looking into a VPN-like solution for accessing most if not all of your services. Still spend time on securing your intranet, but most of your risk is going to come from how hard it is for people to get past the front door (or doors).











  • To be fair… I read the whole interview a few days ago, she was kind of pushed into this statement. The idea from the CEO was presented as a high-end luxury mouse that you’d treat like a fancy watch you could just repair and never need to replace. The closest we got to Logitech saying this was the interviewer asking if they could ever see a subscription being attached to the mouse and the CEO saying ‘possibly’ and then implying that it could be something like a maintenance/repair contract so that you would never have to worry about your mouse.

    This whole ordeal was mostly just poor form in interviewing where the interviewer pushed the interviewee into a statement that they knew would be good clickbait.




  • They definitely could, but most cybersecurity departments are paid too much to worry about minor items like that. If HR tells us to look into a specific user and gets the proper approvals so that everything is in compliance, we’ll definitely get someone on the team to do it, but otherwise if we happen to see evidence of unapproved usage, we’re mostly going to overlook it unless it could lead to something dangerous to your machine or the company as a whole.

    EDRs like Crowdstrike can see very very nearly everything you do though, definitely everything you would care about.