[hackercomplex]

I think that "APT" is just a fancy new word that describes a very old methodology that has been commonplace since the earliest days of computer crime. If you read about Kevin Mitnick for example he was doing this stuff in his early teens.

I think that you may have a dangerous attitude about it because in modern times it's not a question of whether or not you're a big enterprise or a startup it's a question of whether or not the dataset at the nucleus of your system would be valuable on the black market or not. If an attacker or group of attackers thinks that your dataset could be saleable one day in the future as your company continues to grow then instead of trying to buy your equity on the secondary markets they may invest in trying to "own" your infrastructure now before you become big enough to put your employees thru white-hat training around social engineering.

I suppose my point here is that it does make sense for startups to put their team through proper white-hat training but it doesn't have to be expensive because you can roll your own. What I suspect is that in 10 years or so this kind of anti-social engineering training will be a standard for any IT knowledge workers not just programmers and will likely be part of the job interview process.

We are aruging over something moot though, since we both agree.. take it seriously.

[jvehent]

It's all a matter of prioritization. In an ideal world, address all the issues and be perfectly secure. But if you have to choose by priorities, private ssh key compromise is not exactly at the top of my concerns because people are generally careful about their keys.