@MissyIsMaga Theres enough information embedded in a USPS Intelligent Mail barcode (which you didn’t redact) to reasonably determine your location. i’d recommend you delete that.
@IceSolst S1 will likely to protect better in the end, but at the cost of needing more engineers to tune and manage. CS is a great out of the box solution that doesn’t impact business functions too much.
@SwiftOnSecurity Your screenshot is June 06, which happens to be when squid 2.6 came out which added a default deny ACL. Things weren’t all hidden behind NAT, particularly at universities and small businesses taking an internet test ride. And lots of bad admins.
@robertgraham In Jen’s fedspace world it is quite likely that many windows endpoints have poorly patched agents listening on the NIC, mismanaged configurations, etc. avoiding public wifi, especially ones that do not enforce client isolation, is a relevant user level control to reduce risk.
@duosec - What would it take for you to design in an MFA fatigue testing feature? We just need a method to send our users fake auth prompts, and report on who responded. This would greatly augment awareness/training efforts for a common threat vector.