1) Ban smartphones in schools, preventing the use of convenient MFA TOTP apps
2) attackers phish schoolkids' accounts
3) attackers set up MFA on the stolen accounts to make it harder for admins to recover
4) admins disable the ability to set up MFA on all accounts to prevent attackers from doing it first
5) ...
6) Profit?

Original source post: https://bsky.app/profile/did:plc:bya76aoajvy6ihmaviywjcil/post/3lyiunxfesc2c

#EdTech #EdPolicy #TechPolicy #InfosecFail

JFC. The stupid... it burns.
Rly Portland School district?

#infosecfail #portland
From: @null
https://puddle.town/@null/115171765470756871

They changed their password requirements. So the password that I had *already set up* and *used* was no longer valid. I had to reset it.
😠

#infosec #InfosecFail #PasswordFail

Der vermehrte Einsatz von #Passwort-Tresor-Anwendungen ist eine gute Sache, weil man damit
a) ausreichend lange und nicht vorhersagbare sowie
b) separate Passwörter für jeden Login
erzeugen und ablegen kann.

Aber wenn man nur ein schwaches Master-Passwort (oder sogar nur eine PIN) verwendet, serviert man alle seine Daten Angreifern frei Haus.

Also:
- starkes Master-Passwort (oder #2FA),
- nur die PW zugreifbar, die man wirklich braucht,
- am besten keine Online-Tresore.

#InfoSecFail

File under "least smallest surprises of the year"

"US State Dept has no idea if its IT security actually works, say auditors
End-of-life systems still in use, poor inventory control, and China's hunting"
https://www.theregister.com/AMP/2023/10/02/us_state_security_gao

#infosec #infosecfail #enterpriseSecurity #milspec #NAO