Comment Re:"and found no evidence of exploitation" (Score 1) 32
I agree even very well intentioned, honest people have just about everything telling them not to look to hard.
Consider you work for MSCRT and get the report from bug bounty. You confirm the issue, and you do the right thing and turn on the klaxons at MS.
After a little background check to confirm the reporter isnt likely a compromised person you look for 'obvious' signs this was exploited. Finding none, you report your initial results up the chain. Now your job is evaluated on closed incidents / reports at least in part. Your manager tells you wrap this one up close it out, because he knows everyone above all the way up to the C-suite, does not want this to be huge black eye.
Would you go on a phishing expedition in search of more tiny, easily disputed IOCs trying to sift back thru logs for a span of a year or more, knowing the really dangerous guys often have very long dwell times, or would you move on? If you found real proof of an issue you might be hero -or- motivated interests might try to discredit and vilify you, if you don't find anything you might be accused of violating instructions or even get into trouble for looking at logs and systems without an official cause..
there just isn't anyone even down to the front line engineers that really would *want* to find a problem if there was one. Just about everyone at levels at least in the near term has a better day if they 'see no evil'