mcfunley

Maybe take a few steps farther back

Yeah I agree, caveat emptor and all that. The blameful framing is bad work product though.

The point is really after working through remediations, there were pretty massive issues remaining that weren’t hard to find and were relatively vastly easier to exploit if the attacker is a Russian teen and not Bruce Lee. And the budget for such things was blown. Priorities, etc

I worked at a company that had hired Mitnick as a security consultant.

His report for a client that turned out to have been rife with SQL injection at the time was largely movie plot physical security stuff. Not wrong exactly, but not the center mass of the threat model they needed either.

He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent. Counterproductive at best. It seemed like his PR exceeded his utility by a great deal.

That trend continues beyond the grave, maybe.