We had a State security audit

[Bryan E. Wooten]

On 3/5/13 6:33 PM, "Paul B. Hill" <pbh at MIT.EDU> wrote:

>> One of my co-workers also caught the bogus CAS page, fired up jmeter and
>> hit the bogus login page with 20,000 login attempts. That brought the
>> bogus login web server down. Got to love DDOS. The auditors said that
>> was unethical. Hehe.
>
>If the machine was owned by the state, and was being used for an audit,
>then launching a DoS attack on the machine was probably a violation of
>state and federal law.
>
>Count calling the reaction unethical instead of a visit from a
>prosecutor a gift. :)

>

This is interesting. We've had students on our network perform DDOS on our
servers in the past. As soon as we detect it, we shut them down, usually
at the firewall. We can't tell a state owned machine from a private
machine on our network (think wireless or VPN). Did my buddy really break
some law? Being proactive to protect patient and FERPA data?


What a strange world. I can't jailbreak my phone and I can't protect state
data? How do we differentiate a legit audit from a rogue state employee?

-Bryan