<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Followup to the previous message<br>
</p>
<div class="moz-forward-container"><br>
<br>
-------- Forwarded Message --------
<table class="moz-email-headers-table" cellspacing="0"
cellpadding="0" border="0">
<tbody>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Subject:
</th>
<td>Re: [Baen Baen's Bar] Cybersecurity</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date: </th>
<td>Tue, 19 Feb 2019 14:44:39 -0600</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">From: </th>
<td>piobair <a class="moz-txt-link-rfc2396E" href="mailto:piobair@mindspring.com"><piobair@mindspring.com></a></td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Reply-To:
</th>
<td><a class="moz-txt-link-abbreviated" href="mailto:baens_bar@bar.baen.com">baens_bar@bar.baen.com</a></td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Organization:
</th>
<td>Baen's Bar</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">To: </th>
<td><a class="moz-txt-link-abbreviated" href="mailto:baens_bar@bar.baen.com">baens_bar@bar.baen.com</a></td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">Newsgroups:
</th>
<td>Baen_Baens_Bar</td>
</tr>
<tr>
<th valign="BASELINE" nowrap="nowrap" align="RIGHT">References:
</th>
<td><a class="moz-txt-link-rfc2396E" href="mailto:q4heju$l9n$1@bar-test.baen.com"><q4heju$l9n$1@bar-test.baen.com></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre style="white-space:pre-wrap; word-wrap: break-word; font-family: Verdana,Geneva,Lucida,'Lucida Grande',Arial,Helvetica,Sans-serif;">From my friend:
Yes. We ended up using (X) for an internal and external penetration test. It was an interesting, if not exhausting, project. They did find some stuff that we needed to address. Nothing was exposed EXTERNALLY or to any public network that needed to be addressed. But we knew that already. For internal, there were some cases of things that we ended up shutting off or restricting. In two cases we ended up creating a few tiny firewalls using Raspberry Pi's to help restrict access to a few machines that we didn't consider secure enough.
We are a relatively small and controlled operation. I would hate to see all the stuff that would come up in a large operation (the (X) people did tell us some scary stories).</pre>
</div>
</body>
</html>