Defence in Depth --- Thanks Alan for this useful link. Quick clarification of terms for the others: - 2FA: two-factor authentication (an additional code or one-time password to accompany your username and password; often this code is created on your phone, or a special gadget) - the principle of least privileges: giving the minimum necessary access rights to each user in a system - to be able to access only what he/she needs, nothing more than that - VLANs or virtual local area networks: breaking down the computer network into smaller segments, with virtual borders among them to prevent 'crossing'.

These measures certainly help reducing chances for the adversary to penetrate deeper into the network, or to the connected segments.

But, as always, there is no 100% security. Certainly, FireEye had most of this in place already, but it didn't help much (since the compromised system had to have higher privileges in order to work; but they didn't expect it could be compromised).

So - let's make sure we assess the risks, but also accept some of it - and work with that in mind.

Source author: Vladimir Radunovic vladar@diplomacy.edu