I don’t think people truly understand how bad it is.
15 years ago I helped do a PCI/SOX compliance evaluation for a company looking to go public.
They had PWC in there with kids fresh out of college, no computer experience, and they would sit at the desk with the admins and say, “show me your Active Directory password policy”. Ok, looks good. CHECK
Why don’t you have this configured? I’d hear an alarming bullshit reason. Ok, we can exempt that. CHECK
I could go on and on and on with how bad it was.
And they bragged to potential investors. We are PCI/SOX complaint.
I would have considered "the system" to also include password reset policies.
Not a surprising end result for the company that told employees to install OpenClaw on their work laptops.
I don’t think people truly understand how bad it is.
15 years ago I helped do a PCI/SOX compliance evaluation for a company looking to go public.
They had PWC in there with kids fresh out of college, no computer experience, and they would sit at the desk with the admins and say, “show me your Active Directory password policy”. Ok, looks good. CHECK
Why don’t you have this configured? I’d hear an alarming bullshit reason. Ok, we can exempt that. CHECK
I could go on and on and on with how bad it was.
And they bragged to potential investors. We are PCI/SOX complaint.