Hacker News new | past | comments | ask | show | jobs | submit login

We had a client insist that the SSH prompt be changed to include a half-page rambling about it being an "proprietary system" and "access prohibited for non-authorized users", something like that. Failing to include their specific wording, when we did their new staging setup, was a critical, must fix now bug.

Their argumentation was that it was a regulatory requirement and would allow for prosecution.




This is a regular sight when accessing a US government computer system. Even managing things like Global Entry come with such a warning.


These types of messages largely stem from NIST 800-171 (and related standards). Specifically NIST 800-171 has the control "Display a system use notification message with privacy and security notices consistent with applicable CUI [controlled unclassified information] rules before granting access to the system." So it is very common when dealing with companies that are government contractors or subcontractors. 800-171 also sometimes gets used as a security framework even when not dealing with the government so these requirements sometimes end up outside those contexts as well.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: