• 0 Posts
  • 46 Comments
Joined 2 years ago
cake
Cake day: August 2nd, 2023

help-circle











  • A layered defense is always best. Nothing is 100%, but knowing your threat model will help define how far you have to go and how many layers you want in the way. Defending against State level actors looks different than swatting the constant low effort bot traffic. You’re right, if a bad actor gets root on your machine, all security is forfeit. The goal is to minimize that possibility by keeping applications and packages updated and only allowing necessary connections to the machine. You mentioned wireguard or tail scale. Set that up first. Then set up the host firewall to only allow outbound traffic onto the VPN to the required ports and endpoints on the LAN. If the VPS isn’t hosting any public facing services, disable all traffic except the VPN connection from and to the public Internet both on the cloud provider’s firewall and the host firewall. If it is hosting publicly accessible services then use tools like fail2ban and crowdsec to identify and block problem IPs.









  • While others are focusing on the legal aspect, which I guess is the question you actually asked, my first thought was bare minimum compliance while gathering evidence. Grab an old phone, wipe it completely, install the app with all new credentials not tied to you in any way, then just leave it running at work. They get their location data, just not anything usable, you get to submit a minimum number of receipts that doesn’t get you in trouble from purchases you would have made anyway, or not because why support scumbag companies. You get to gather more hard evidence of their assholery that way. Never install work apps on your personal phone. If they require something for your job, they should provide the hardware to run it on.