Assurance

["Cantor, Scott" <>]

On 6/25/13 3:10 PM, "Brendan Bellina" 
<>
 wrote:
>
>I think these DOS points are well-taken and have raised them myself with
>auditors and such who don't seem to take this risk seriously.  Since
>University account logins are usually obvious and systems are public we
>are at greater risk than corporations where account logins are not
>obvious and systems are not public.

I recall discussing this on the InCommon TAC with Joe, and I raised the
question as to whether there's concrete evidence this actually happens.
The attitude here was/is "sure, in theory, but nobody's going to do that".

Hard to refute that without any evidence to the contrary.

We do have hard evidence from logs that nobody's brute forcing our
accounts (literally nobody). Phishing is far simpler and more effective.

-- Scott