Thread by @malcomvetter

A recently mobilized toddler is like a free home penetration test.

Like any enterprise penetration test, the (ahem) “stakeholders” (me) might say: “How long has that been there? Whose is it? Did you know we had that there? Who’s responsible for that?”

First rule of security: asset inventory.

Followed up with: “Well, you’re not supposed to do that” and “You’re not following the rules.”

Eventually comes: “Are we going to fix that now or just respond every time she breaks it?”

If it’s not your first one: “I thought we put one of those keep-out access control thingies over there. Didn’t that work last time? Is it broken? Did you check it? When did it stop working?”

Eventually it’s: “Dangit, she got into it again. Weren’t you watching? Who was watching? Who is supposed to watch? You were distracted weren’t you??”

“Oh, this is sooo exhausting. Can’t she just find something ELSE to get into?? How many times do we have to clean up the same mess?”

Pentesters: Maybe your stakeholders will be amused if you just knock everything down and let out a cute little “uh-oh.” #ProTip

Best ones are when you find insider collusion.

“Which one of you thought it was ok to give her [x]? Why did you leave the door open? Don’t you know what could happen??!?”

Forget “Chaos Monkey”.

Far scarier to call it: “Mobile Toddler.”

#EverythingYouNeedToKnowAboutInfoSecYouCanLearnThruParenting