Chris Colotti’s Post

Pretty sure some have seen this already but to say the least…this is pretty fucking huge. When it’s either a concerted cover up or just pure ignorance there will end up with heads on spikes especially when your a public company. What makes this interesting is it’s NOT just about he breach. It is targeting the internal security controls as well as lack of disclosure and transparency. If you didn’t think a CISO can’t be held liable…think again. Companies better start thinking a lot harder not just about their controls and practices BUT actually ensuring they are in place and working and not “spinning” the details. This will inevitably set a precedent one way or another for sure. The full 68 page complaint is also in the comments

Like many I have seen the #VMware posts last week and I have had multiple calls with people seeking some council on the events. Many of them had their offers and were trying to consider if they wanted to take it or just accept the severance. Some of them expressed thoughts of "going in a new direction completely" to which I told them to go for it. Let's also be honest here for a minute...... The only people making out on this deal are those at the top of the food chain. For the rest of us what we do "for work" is just a job. You got paid (and may continue to get paid) for your efforts. Yes, this is the end of an era for sure, but like anything, time heals all. My council to you is this... - Take this time for YOURSELF, you've given a lot to a company, probably in many cases with very little thanks (outside of your compensation) - Don't try to "keep the memory alive", move on it will be healthier for you in the end - All good things come to an end, embrace the change - Always remember that the employer/employee relationship is not your family, it's a trade off of work for money. If you really want to put yourself into something so completely that you feel it's yours to lose, then go build/do your own thing and make it yours. I hate to be the guy that says the million dollar winners in this deal won't even remember you next week, but they won't. You will survive, you will find a way to continue on, but always remember to look our for YOU and YOUR family, long before anything else. One final word for those that did NOT get an offer or were told you’re services are no longer needed. Chin and bootstraps up. Screw them. They don’t deserve you or what you have to offer. Honestly maybe be glad you were not invited to play the hunger games and go do something better for yourself. Remember that NONE of us make it out of this life alive. Make the most of what youn have now. I am here for those that want to talk, (assuming this whole mess finally closes today). DM, text or call me.

I am really curious.....when did it become so acceptable to send out meeting/zoom invites without any agenda? Let's be honest, it's super easy to shoot off an invite to 10-15 people with just a time and a zoom link. It's takes a TAD bit more time to add an actual detail over what the call is about, and NO the subject line is NOT the agenda. Yes someone once said that to me. People cannot accept or decline requests without details. It's why any invite that lacks an agenda I respond to as "Maybe", because if you don't have any details then it truly is a "maybe I can attend given the current level of detail.", if you add more people can make a better decision if they are needed or ask questions ahead of time.

Been getting texts and messages from some of my current VMware friends getting offer letters today. To them I guess sort of “congratulations” is in order to be one of the chosen ones at least for now. Most of the people I’m still close to seem to all have gotten offers of some kind and they all have some hard decisions to make in the next couple days about your future there or elsewhere. This whole ride will hopefully be over soon for all of you for better or worse.

For the last couple weeks I have been on a tear about small businesses incorrectly adding on "convenience fees" when instead they are really allowed to add on a "surcharge". To my small business friends that are adopting this practice, please do not get mad at me for educating people, and I urge you to reconsider this practice. If you are not aware they are not the same thing. In most cases I am finding merchants have not understood the rules of these fees either. I spent some time this weekend putting together information from multiple references to hopefully help educate consumers better on this. I still feel as though this should be illegal in all states, however as consumers we can start to push back on merchants that are incorrectly assessing these fees and/or not following the rules to disclose them correctly. Lastly, there are ways to report these infractions to VISA/MC/AMEX and the state Attorney General's office. Please add your own commentary on this topic, share this post/blog and talk to your friends that are small business merchants about this. For the record STK Promotions that my wife runs has NEVER adopted this practice. https://lnkd.in/eedGQbzS

I have to say....I absolutely love this. Winter is coming for some companies if they are not careful. Changing policies is fine, trying to change them retroactively is shady as shit. Either way the outcome of this, it will set a precedent for employees and employers. Keep your heads on a swivel, I will bet that more companies will tie your bonus to how often you are actually "in" the office. This will become a sledgehammer approach in no time and if you are not paying attention you just might get caught in it.

This is going to once and for all kill the experiment formerly known as “X” for sure. I don’t know anyone that will pay a subscription just to use it. Yes I know people that have paid for their little blue X but the vast majority won’t do it. The fact even LinkedIn and Facebook haven’t been able to move that way makes me wonder what makes this egocentric dipshit think he can do it. Not going to happen it’s going to die once and for all I’m sure. https://lnkd.in/eVT8CZea

So….Okta services compromised first then ESXi directly attacked. Now things get more interesting. I’m starting to wonder how Okta access then led to direct ESXi access. Also how many companies now adopt an "Okta First/Everything" methodology?? 🤔 Now that seems like a point of initial attack for sure.. The only thing I can sort out is ESXi using LDAP/AD at the host which is not uncommon BUT then do we assume SSH was open? Okta won’t get you ESXi root creds but could get so SSH access and if you assigned an AD user root level access locally first then yeah your in. I’m totally spitballing out loud here but bottom line is based on this they got logon access directly to ESXi or did they exploit a vulnerability remotely that wasn’t patched? Yet to be determined but could have actually been the latter if the versions and patches weren’t up to date. The tone of this does feel as one person stated as “a white hat gone black hat” based on the mentions of insider trading and corporate greed. It’s also fair to mention almost NOBODY backs up the ESXi “OS” layer. Configs maybe or more likely host profiles or LCM level Re-deployment, VMs definitely but honestly in 20+ years I’ve rarely seen ESXi itself directly get backed up or even vendors promote any ability to do so. Almost all of them focus on the VMs running on ESXi but not ESXi itself. 🤔 food for thought there too. Please comment on that part maybe I’m wrong? PS - I am NOT a security guru, I am just applying common sense here and there, and a lot of "what if's" :)

When everything is a work around or a quick fix, and you never take the time to address the root cause of the issue.....eventually you are just a dog chasing its tail. Problems ignored long enough do not in fact go away...they continue to get worse until you are forced into a major effort to fix what was a much simpler problem. Then again what do I know right?

Well that’s a biggie. I’ve long heard from folks that worked for casinos over the years that their many of their systems were aged and not well maintained. Those folks also talked about how they rarely spent money to improve them (even though they basically print money). I am not sure if that’s still the case here but only time will tell how it got in but also an interesting case for some additional segmentation as it seems reading that it spread wide across multiple properties which would indicate maybe some lack of basic segmentation? Dunno just speculating with 🍿 at this point.