3 ms·

How does Palantir's response stack up? Having read the article, I'm not sure whether to read it as: "The extent to which the red team was able to exploit the n

How does Palantir's response stack up? Having read the article, I'm not sure whether to read it as: "The extent to which the red team was able to exploit the network is a sign that Palantir's network security is bad" or, "Despite Palantir following best practices and having a lot of smart people on their security team, the red team was still able to do a lot, which bodes really badly for other companies that don't have the same internal resources"?

rando289 10y ago
"Our systems and our customers’ information were never at risk.", their pr team is clueless. Security is not binary.
- argonaut 10y ago
  The fact that they had a specific team test their security is already evidence they aren't clueless. Clueless would be refusing to have teams test your security.
  - late2part 10y ago
    Two kinds of people - those who've been hacked and those who say they haven't.
  - rando289 10y ago
    I didn't say they were clueless. I said their pr is clueless. Some pr person said "there is no risk" relating to it security of a large organization. That is obviously false, and clueless.
- meowface 10y ago
  Were never at risk as a result of this pentest. Obviously, there is still a risk of data loss... but that risk is present among nearly every company on Earth.
keithpeter 10y ago
According to the report (and I'm never sure how far one can trust leaked documents simply because you don't get the full context) the intrusion was not noticed until the intruders reached one compromised laptop that had non-standard software installed on it (LittleSnitch) that tripped an alarm when the intruders tried to upload a screen shot. Perhaps best practices might include more and more varied trip wire software of this nature? Disclaimer: I'm a civilian. My exposure to infosec begins and ends with being careful about email and USB drives.

rando289 10y ago

"Our systems and our customers’ information were never at risk.", their pr team is clueless. Security is not binary.

argonaut 10y ago
The fact that they had a specific team test their security is already evidence they aren't clueless. Clueless would be refusing to have teams test your security.
- late2part 10y ago
  Two kinds of people - those who've been hacked and those who say they haven't.
- rando289 10y ago
  I didn't say they were clueless. I said their pr is clueless. Some pr person said "there is no risk" relating to it security of a large organization. That is obviously false, and clueless.
meowface 10y ago
Were never at risk as a result of this pentest. Obviously, there is still a risk of data loss... but that risk is present among nearly every company on Earth.

keithpeter 10y ago

According to the report (and I'm never sure how far one can trust leaked documents simply because you don't get the full context) the intrusion was not noticed until the intruders reached one compromised laptop that had non-standard software installed on it (LittleSnitch) that tripped an alarm when the intruders tried to upload a screen shot. Perhaps best practices might include more and more varied trip wire software of this nature? Disclaimer: I'm a civilian. My exposure to infosec begins and ends with being careful about email and USB drives.