AzureAD and shares
-
@scottalanmiller said in AzureAD and shares:
@Obsolesce said in AzureAD and shares:
I would say it's an issue of old outdated SMB versions with bad access and authentication practices.
That is a factor, too, of course. Anything outdated ups the risk. But for systems properly maintained, those things don't exist.
Bad things happen with good solutions when they are not implemented and maintained correctly.
-
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
-
@brandon220 said in AzureAD and shares:
If you had a client/friend/relative and needed a file server for 'reasons' and they only knew MS since birth - would you still install a samba file server if licenses were not a factor?
Honestly, yes. For the very reason you mention.... someone who "only knows one thing", don't actually know that thing and are the most dangerous of people. Making it easy for people who don't understand to break things is really the worst option, IMHO . It's costly, and risky. Making IT "seem easy" is one of the biggest mistakes of the MS ecosystem.
-
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
-
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
-
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could. -
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
-
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
-
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
In general yeah, but the GPL police are fierce. I work with a guy who's old company was going to be sued for not including the simple configs they wrote along with the distribution.
-
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
In general yeah, but the GPL police are fierce. I work with a guy who's old company was going to be sued for not including the simple configs they wrote along with the distribution.
Yeah, although now we are talking product firms, not operations. The affect on operations is generally minimal.
-
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
In general yeah, but the GPL police are fierce. I work with a guy who's old company was going to be sued for not including the simple configs they wrote along with the distribution.
Yeah, although now we are talking product firms, not operations. The affect on operations is generally minimal.
Yeah true, but that's similar with proprietary also, most people don't get caught. You still have to comply though. It can be a lot of work to ensure you're in compliance. Like when software decides to change licenses between versions.
-
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
In general yeah, but the GPL police are fierce. I work with a guy who's old company was going to be sued for not including the simple configs they wrote along with the distribution.
Yeah, although now we are talking product firms, not operations. The affect on operations is generally minimal.
Yeah true, but that's similar with proprietary also, most people don't get caught. You still have to comply though. It can be a lot of work to ensure you're in compliance. Like when software decides to change licenses between versions.
Like java?
-
@Dashrender said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
In general yeah, but the GPL police are fierce. I work with a guy who's old company was going to be sued for not including the simple configs they wrote along with the distribution.
Yeah, although now we are talking product firms, not operations. The affect on operations is generally minimal.
Yeah true, but that's similar with proprietary also, most people don't get caught. You still have to comply though. It can be a lot of work to ensure you're in compliance. Like when software decides to change licenses between versions.
Like java?
Yeah that could be one. I was thinking more along the lines of changes like MongoDB, CockroachDB, Redis, etc. And even less obvious like when OwnCloud switched from GPL v2 to AGPL (before NextCloud came along). AGPL is quite a bit more open than GPL v2 is so you would need to be aware of any changes there.
-
-
-
@Dashrender said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
In general yeah, but the GPL police are fierce. I work with a guy who's old company was going to be sued for not including the simple configs they wrote along with the distribution.
Yeah, although now we are talking product firms, not operations. The affect on operations is generally minimal.
Yeah true, but that's similar with proprietary also, most people don't get caught. You still have to comply though. It can be a lot of work to ensure you're in compliance. Like when software decides to change licenses between versions.
Like java?
Well that's an example of license compliance where proprietary makes IT make mistakes easily. But totally different than the open source risk, which is a risk to developers who try to "steal code" rather than IT trying to "deploy without checking the EULA".
-
@stacksofplates said in AzureAD and shares:
@Dashrender said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@stacksofplates said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
But, honestly, not nearly as hard as the risks of anything else. And "can be" should never be a legitimate factor. ONce we go down that path, we could list unrealistic risks for forever.
Right, like I said I'm not defending them. Just trying to look at it from all angles.
What people never consider is that closed source licensing COULD still require in the EULA that you comply with GPL of your own code simply by using the closed source product
Cloud source EULAs can pretty much carry any risk imaginable. They don't, but they could.Yeah definitely true. I don't like closed source at all. I mean if I need the tool I'll buy it but I'd rather use a open source tool.
I've seen a lot of people thought that think they can just do whatever since it's open source and it doesn't matter. AGPL is pretty strict and there's a lot of popular tools written with that license.
In most cases, it's people thinking that they can just use the code without following the license. Technically, a far bigger risk with closed source under the same conditions.
In general yeah, but the GPL police are fierce. I work with a guy who's old company was going to be sued for not including the simple configs they wrote along with the distribution.
Yeah, although now we are talking product firms, not operations. The affect on operations is generally minimal.
Yeah true, but that's similar with proprietary also, most people don't get caught. You still have to comply though. It can be a lot of work to ensure you're in compliance. Like when software decides to change licenses between versions.
Like java?
Yeah that could be one. I was thinking more along the lines of changes like MongoDB, CockroachDB, Redis, etc. And even less obvious like when OwnCloud switched from GPL v2 to AGPL (before NextCloud came along). AGPL is quite a bit more open than GPL v2 is so you would need to be aware of any changes there.
But, important to note, that in one case the changes affect developers, the other IT. The OS license changes is mostly a change to how you use the code, not the product. Prop changes are changes in how you use the product, not the code.
But proprietary has the risk of turning INTO open source, so carries all the OS risks anyway by the nature of being able to change its license, too.
-
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
FFIEC Cybersecurity Assesment Tool
It is REALLY fishy that a government agency is trying to put small banks at risk and goes directly against requirements for the big institutions.
Have you DEALT with a government agency lately? Just last week I had to fix a client's access to the Social Security billing system which is forcing use of Internet Explorer 11 to run software that downloads on demand and establishes a VPN into the main billing system database. They think they're secure, but use a security model from the 90s at best on old browsers that should have been retired.
-
@travisdh1 said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
FFIEC Cybersecurity Assesment Tool
It is REALLY fishy that a government agency is trying to put small banks at risk and goes directly against requirements for the big institutions.
Have you DEALT with a government agency lately? Just last week I had to fix a client's access to the Social Security billing system which is forcing use of Internet Explorer 11 to run software that downloads on demand and establishes a VPN into the main billing system database. They think they're secure, but use a security model from the 90s at best on old browsers that should have been retired.
They don't think they are secure - they just have a platform that 'worked' in the 90's and amazingly still works, so they won't update it.
-
@Dashrender said in AzureAD and shares:
@travisdh1 said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
FFIEC Cybersecurity Assesment Tool
It is REALLY fishy that a government agency is trying to put small banks at risk and goes directly against requirements for the big institutions.
Have you DEALT with a government agency lately? Just last week I had to fix a client's access to the Social Security billing system which is forcing use of Internet Explorer 11 to run software that downloads on demand and establishes a VPN into the main billing system database. They think they're secure, but use a security model from the 90s at best on old browsers that should have been retired.
They don't think they are secure - they just have a platform that 'worked' in the 90's and amazingly still works, so they won't update it.
No, I talked with their support people, they insist that their "system" is secure.
