4 ms·

Even the tens of thousands could be a stretch for the actual cost. When I was handed a copy of my Pre-Sentencing Report, for an incident that took place on Jun

Even the tens of thousands could be a stretch for the actual cost. When I was handed a copy of my Pre-Sentencing Report, for an incident that took place on June 21, 2011, they billed from June 16-24. I pointed out that I did not own a time machine, then they quickly changed the dates to June 21-27 and dropped the "damages" by over 60%. That's the difference between certain prison time and probation with house arrest. (This was Sylint, maybe they're just scumbags and wanted to make as much money as they could off my mistake.)

tptacek 11y ago
I'm sorry, but this just isn't correct. It's hard to imagine any outside forensics investigation happening for less than $20k ($50k is a more reasonable estimate), and those outside investigations are often mandatory in breach cases. Insurance companies and, sometimes, regulated data protection usually require that the company take steps to ensure that everyone knows the limits of the attack --- and those limits, as you know, aren't at all obvious from the attackers overt actions. It looks like the attackers just fucked up a bunch of web pages. But they broke in; how do you know they didn't leave backdoors, or exfiltrate databases? You often don't, unless you engage an outside firm to verify.
- sarciszewski 11y ago
  > It's hard to imagine any outside forensics investigation happening for less than $20k In my case, Sylint was the web host and the forensics investigator. That might also explain their duplicity and lack of consistency in the reports to the court. Aside, is knowing how to use Encase really that lucrative? I should switch specialties.
  - tptacek 11y ago
    I agree that EnCase jockeys are overpaid, and I generally think of forensics as a lower-status specialty than software security, but website breach investigations are much more annoying than just imaging hard drives.
    - sarciszewski 11y ago
      I can only imagine, especially if the logging/auditing policy was "pretty much non-existent" and you don't know how extensive the access was for a given user account (nor how much of that access could have been used in the short window of compromise). If it were SSH access, I'd call it game over.
nmrm2 11y ago
A "Business Management Consultant" group focused on "cyber" security? You shouldn't have been surprised ;-)
- sarciszewski 11y ago
  Four years ago, I knew practically nothing about the security industry (or of business). I was a self-taught web programmer who knew really obvious ways to defend websites from attackers.

tptacek 11y ago

I'm sorry, but this just isn't correct. It's hard to imagine any outside forensics investigation happening for less than $20k ($50k is a more reasonable estimate), and those outside investigations are often mandatory in breach cases. Insurance companies and, sometimes, regulated data protection usually require that the company take steps to ensure that everyone knows the limits of the attack --- and those limits, as you know, aren't at all obvious from the attackers overt actions. It looks like the attackers just fucked up a bunch of web pages. But they broke in; how do you know they didn't leave backdoors, or exfiltrate databases? You often don't, unless you engage an outside firm to verify.

sarciszewski 11y ago
> It's hard to imagine any outside forensics investigation happening for less than $20k In my case, Sylint was the web host and the forensics investigator. That might also explain their duplicity and lack of consistency in the reports to the court. Aside, is knowing how to use Encase really that lucrative? I should switch specialties.
- tptacek 11y ago
  I agree that EnCase jockeys are overpaid, and I generally think of forensics as a lower-status specialty than software security, but website breach investigations are much more annoying than just imaging hard drives.
  - sarciszewski 11y ago
    I can only imagine, especially if the logging/auditing policy was "pretty much non-existent" and you don't know how extensive the access was for a given user account (nor how much of that access could have been used in the short window of compromise). If it were SSH access, I'd call it game over.

nmrm2 11y ago

A "Business Management Consultant" group focused on "cyber" security? You shouldn't have been surprised ;-)

sarciszewski 11y ago
Four years ago, I knew practically nothing about the security industry (or of business). I was a self-taught web programmer who knew really obvious ways to defend websites from attackers.