Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I agree, I still think it's a reasonable word to include in the instructions though.

What you don't want is them holding back how much they co-operate with the red team in the drill because they think that's how they would act, or they'd like others to think that's how they would act. Even if it is how they would act, you'd presumably like to know that your security measures would still work even if someone else was in their positions. But also, it's pretty obvious that no-one (or very very few people) know how they'd really act in that sort of situation.

I thought (edit: And still think, but acknowledge that it is not yet a well thought out plan) putting that word in was a nice short form way of achieving that goal, though in a real drill you'd want to communicate a whole lot more about that than the 3 words I used. And probably also communicate that were this to happen in a non-drill form, that you don't expect them to resist.

Incidentally, it's hard for me to imagine that there are many organizations outside of the military / national security that include armed invasion of their offices in their threat model, though I suppose some multinational corporations might.



The idea of drilling an armed invasion to test security protocols of IT systems and access is absolutely insane.

I’ve worked in the highest levels of NatSec and have never even heard of this.

Either the story is exaggerated, or it’s in a country where shenanigans like this are allowed.


I can see the engineering appeal in this idea: testing beyond the expected operational envelope will tell you which parts of the process break first.

As for applicability, every now and then you hear a disturbing story of some office being raided by the police / anti-corruption force - this is not unrealistic if you're e.g. a news agency in a country whose government doesn't always respect the freedom of press.


But having actual armed with (fake or not guns for a drill?)

Nah, too much could go wrong, security guard shoots them, somebody gets brave and jumps one of the “terrorists”, etc…


Spending four paragraphs justifying how well a word communicates something when you could just replace it with the phrase “to simulate not brown-nosing (I would die for this job)”.

Hail corporate.


You know the saying "I didn't have time to write a short letter, so I wrote a long one instead" (Mark Twain, maybe). Ya, that's what I did, your version is just better.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: