Weak Access Controls

• Not so rare!

• • distcc
  • phpMyAdmin (non-existant password)
  • MSSQL 'SA' account
  • Mitnick (rsh)

• Carefully consider your authentication model

• • You did white-board it, right?
  • And got others to look at it?