The scariest thing in most systems
isn’t the part you’re watching.
It’s the part you forgot you had.
The old server still running.
The endpoint from a project that ended.
The test box, quietly on the network, for years.
You can’t protect what you can’t list.
I learned to start security
with an unglamorous question:
what do we actually have?
Make the inventory.
Find the forgotten things.
Turn off what shouldn’t be on.
The breach usually comes through
the door you didn’t remember existed.
– Serguey Asael Shinder
Leave a comment