Layered defence. These days, why do you have anything unauthenticated anywhere? Every system should be authenticated and authorized. Unless information is fully public.
2. As for the rest, take them down one by one and see what breaks. Got a call to internal support hotline? "Ooops, sorry, we will turn it on and let's chat about it soon."
There can be a few announcements in advance to shift the blame before (2): "Declare yourself or face consequences" (ChatGPT will write a nicer email). If you are on good terms with CFO, the noise won't matter. In fact, many people will thank you, when their weird stuff is taken over for care by IT.
It makes no sense that you'd keep an insecure service because you forgot someone needs it. You turn it off and the reminder will promptly come to you. After this it's a decision, not oversight.
> It’s nothing to do with costs, its just an oversight
The article suggests that their internal unauthenticated SMTP was there by design, not oversight, together with an authenticated (presumably external) one. Some assessment deemed addressing the risk from the unauthenticated internal one not worth the cost and effort.
> People connecting through our VPN have access to an internal-only SMTP gateway machine that doesn't require SMTP authentication [...] previous phish spammers have exploited some combination of webmail and authenticated SMTP.
You’re assuming an org that had a policy my in place for this which was followed all along, and not that it’s a piecemeal service barely held together by dreams and prayers. My experience with university It departments is there’s an _incredible_ amount of “dunno who that belongs to but don’t touch it because it might be important” going on.
Right, so not an oversight, but a decision not to touch the obscure system. Decisions with bad outcome aren't oversight unless you want to downplay them when justifying yourself.
Your SMTP gateway is never "that" system that nobody knows about. You must know who owns and manages it, you know you have to secure it (minimal measures like... authentication) so you don't get unceremoniously penetrated. And if you do it you may or may not realize that something will fail because of the extra security.
If you know that "one cobbled together system, or old network MFP" I was mentioning earlier will fail when you enforce authenticated SMTP, because it's too old and replacing it is $$$, or too arcane and bringing an expert is $$$ then you will take an informed decision whether to proceed with your security hardening or not.
If you have no idea something will fail (you didn't catch it in the dry runs) if you enforce authenticated SMTP, you just do it and if someone comes in a frenzy to tell you that the old and arcane system is down then you revert the change. Now on you're in the informed decision scenario from above.
This is not a minor omission. Leaving a glaring insecurity like this open by oversight isn't what the article suggests happened, and it almost never never the case. It's not something that "just happens", it's something that people meet to discuss about and decide to ignore it maybe for reasons that look good at the time. This is the essence of risk taking. But it's a decision nonetheless.
Nothing was exposed to the Internet, but one of my small fears was seeing spam in the log of that service, that would mean a serious breach.
That's what "every system should be authenticated and authorized" feels like in the limit. So in practice, it always boils down to how deep you go before the overhead starts to eclipse any benefit you get from running the system.
Switching to a modern stack is not just a matter of choosing the summiting. This is easy.
You then must know what days you have. Still manageable somehiw.
Then the processes, maybe the company as a while know all of them (maybe) but this is dispersed amon plenty of staff.
Then you have dependencies. You close z door and a building collapses 10 km away.
Finally there is everything you do not know about many someones added.
Don't get me wrong : I work in cybersecurity. But I know how complicated things are.
Old java based application that doesnt respect all email flags and will often just close the connection even mid successful auth.
New server that lives in the cloud, but doesnt match up with the right protocols to send email out of Azure and into 365, so its punted down to on prem and back up to 365 just so Microsoft can sleep better at night.
These are the most common reasons I have seen.
Physics.
Laziness.
Forget authentication, I know some people who leave their car key in their car and their front door unlocked because they can't be arsed.
For myself, my personal and professional contact lists wouldn't be pleased, and I would apologize to them, but it's not going to cause me to lose any money. I'm certainly not going to be embarrassed about nudity or body shape/condition. Everyone is nude under their clothes, and other people have the same body shape or maybe even medical conditions. (Unhygienics is something else though, and that would be unpleasant.)
Also, I don't let anyone take nudes of me, nor do so myself, because it's just easier to assume that anything digital might be hacked one day.
They don't have to compare, they are both problems.
> Physics.
> Laziness
Redundant. Physics says an object in motion wants to stay in motion and an object at rest (a lazy object, if you will) does too. Ergo, laziness is a property of physics. QED