Support

I had actually read many more articles regarding that hack. It is a textbook example of why security is a process, not an event, i.e. you need to think about security all the time and adapt to new challenges. I, for one, have found that using a password manager and 14-25 character "line noise" (upper/lower case letter, numbers and symbols) passwords is the best alternative to reusing the same old password all over again. Keeping and replicating encrypted backups of the password database is paramount, of course. Updates? My motto is "update, yesterday" and that's the second slide in my security presentation (the first being "backup, backup and backup").

The most disturbing aspect of the HBGary case is the social engineering part. If someone forgets his username and his password and the server's IP he's most likely a hacker. I'd call the guy right away on his cellphone and ask him straight up "are you being hacked or are you becoming senile?". That's why I ask tons of question when someone emails me about a password reset ;)

Yeah, most of the errors where very basic and could have easily been avoided. Custom CMS are a joke. You can never possibly get the level of scrutiny a major Open Source CMS goes. Just the mere fact that its code goes through thousands upon thousands of pairs of eyes, each person having a different experience level and mindset than the other, ensures that vulnerabilities are reported and fixed on time.

For the record, I consider no site or IT infrastructure in general to be unhackable. You can just make it less easy to hack by following common sane security practices, unlike HBGary ;)