6 ms·

"They're portraying the negligent company as the victim!" While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(a

"They're portraying the negligent company as the victim!" While I agree that things like sql injection are negligent, there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Saying "dont hire bad people" is easy, but how do you do that? And the standard for best practices is constantly moving in our industry, how do we decide when it is negligence, and when there was nothing that could be done. Not saying people are being harmed by this, Im just saying its not so black and white. In some cases the companies that were hacked couldnt have reasonably stopped it. I mean, how do you prevent contractors from setting up something that steals credit card numbers? You hired the contractors because you dont have those skills in house.

mattkrause 10y ago
> How do we decide when it is negligence, and when there was nothing that could be done? This isn't an insoluble issue: courts deal with similar decisions in car crashes, medical malpractice, and many other scenarios. A plaintiff could argue that the respondent should have been aware of certain vulnerabilities because they were widely disseminated, or that certain practices are explicitly warned against in common training materials. Respondents might counter by arguing that they test for that type of vulnerability using a widely-accepted tool, but it failed to flag this one issue, or something like that. I agree that it can't be a purely algorithmic process, but almost nothing in a courtroom is.
- ahartman00 10y ago
  Very true, but courts arent known for being up to date with tech.
  - josephg 10y ago
    Courts aren't up to date on medicine either, but they manage to preside over malpractice cases somehow. I'm sure if technical malpractice graced their courtrooms regularly they would manage somehow. Probably by relying on expert witnesses and learn the bits and pieces of jargon they need to know.
CaptSpify 10y ago
Do you regularly hire contractors and then never look over the work they do? Because I don't, and frankly, that's kind of idiotic. The data is your responsibility, not theirs. They also have no interest in the longevity of your company, why would you trust them without checking what they are doing? As a customer, I don't care how Home-Depot handed out my CC info, I care that they did. Sure some hacks happened despite companies putting forth their best effort, but hand-waving the responsibility to contractors is not the answer.
- ahartman00 10y ago
  "Do you regularly hire contractors and then never look over the work they do?" I dont when it comes to software. For say legal services, I dont have many options, as I am not an expert. The point I was trying to make is that sometimes people hire contractors because they dont have the expertise. How are they supposed to review something they dont understand? Saying every organization should have top notch IT on staff so this doesnt happen is hand-waving as well.
  - CaptSpify 10y ago
    There's a famous saying along the lines of "If you are rich, hire two accountants. One to keep track of your books, and another to keep track of the first guy" If you provide sensitive information to anyone that you don't have legal recourse against, then I don't really have any sympathy for you. If you make a bad business decision and it leaks my info, I'm not upset because someone took it without your approval, I'm upset because it was leaked. There's a cost/benefit risk to everything. If you want to take the route of working with contractors, you have to weight the risks for that as well.
    - ahartman00 10y ago
      "If you are rich, hire two accountants. One to keep track of your books, and another to keep track of the first guy" Brilliant, I hadnt heard of/thought of that. "There's a cost/benefit risk to everything. If you want to take the route of working with contractors, you have to weight the risks for that as well." True, I would just like to point out that hiring your own staff might no work out either...
krupan 10y ago
I think I'm with Cory on this. It's negligence if you leak it. Period. Nobody is obligated to hoard and store a bunch of sensitive personal data from their customers.
- ahartman00 10y ago
  In the specific hacks I was thinking of, they didnt hoard and store any info. Equipment was installed that siphoned credit card info from their payment systems. I cant think of a way to run a store without passing credit card info through your payment processing system to the banks.
  - krupan 10y ago
    Agreed, credit cards are a ridiculous necessity. I think in this case the credit card companies should be liable. I am continually amazed by the simple solution bitcoin provides to this problem: instead of me giving you an account number that you (or anyone who gets the number) pull(s) money from, you give me a number that I push money to. It's going to be a long time before that kind of change in our payment systems (from pull to push, whether with bitcoin or some other system) can be widely implemented.
    - ahartman00 10y ago
      "I think in this case the credit card companies should be liable." Maybe? I didnt see anything about home depot suing the contractors? Really, they should be held financially and criminally liable.(if they werent) The public ledger part of bitcoin is great also. You can see where the stolen money went. Maybe if they added a way to flag money, so spending stolen bitcoin would trigger an alert at the merchant, the same way canceled credit cards do now.
      - krupan 10y ago
        re: the contractors being liable, currently the way things work is, when my credit card is used fraudulently the credit card company owns that and pays me back, which is the least they could do. I don't even know if they attempt to work with law enforcement to catch the actual fraudsters, but I sure hope they do. Maybe I should be more proactive about that? I don't know. EDIT: I should point out I don't know any details about the Home Depot "hack" and I might not be addressing all the pertinent points of that particular incident. Bottom line is still the same, it shouldn't be the customers who suffer when this happens. The people that made it so easy for my personal information to leak, the ones who necessitated that my personal information even be required as part of the transaction, should be the ones feeling the pain.
flukus 10y ago
> there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Wouldn't the negligence just be that they had access to the unencrypted credit card numbers?
- ahartman00 10y ago
  Ok, so I was confusing the home depot hack mentioned in the article with the target hack, but I dont want to edit my comment after so much discussion. I also want to point out that i was trying to show an exception, not to say that noone should ever be held accountable for a breach. In the target hack, hvac contractors had their credentials stolen, and malware was installed on their pos system. The home depot hack was malware suspected to have been installed on their self checkout machines[1]. So no, they never allowed anyone access to the unencrypted credit card numbers. Negligence is failure to exercise reasonable care.[2] Bad things happen, and even more so when sophisticated criminals are attacking you. It is impossible to create a fully hack proof system. I would say allowing a sql injection is negligence, but when people are using sohpisticated attacks, there is nothing you can do. 1. http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impacted-malware-contained/#more-27975 http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impa... 2. https://en.wikipedia.org/wiki/Negligence https://en.wikipedia.org/wiki/Negligence
skewart 10y ago
> How do we decide when it is negligence, and when there was nothing that could be done? As others have pointed out, that question is one that courts deal with every day in other industries. IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professional have done in this case?" Would any reasonable contractor have interpreted those drawings to mean the joists should be spaced 24" apart? Or would a reasonable professional have interpreted it to be 20"? The same standard could be applied to software engineering and data breaches. Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016? I suspect as soon as any amount of precedent is set for lawsuits around "hacking" law firms will push open the floodgates and it will suddenly become very common. In the construction industry the frequency of lawsuits has created a culture where people go to great lengths to reduce their risk of liability. Architects draw deliberately vague details around waterproofing and contractors push to have every detail for how to do things spelled out on paper, so they won't be on the hook if one of the steps in the process is wrong.
- sooheon 10y ago
  How do architects get away with vague details when lives can be on the line? If they design the building correctly, they should be pushing to make things as explicit as possible so that when contractors make a mistake it is clear where the fault is. It seems unprofessional that they'd be pushing in the other direction.
  - skewart 10y ago
    For context, the majority of lawsuits in construction involve defects that are far from life threatening. Waterproofing, insulation, or, say, windows not working quite right are more common. There could be millions of dollars at stake because a defective building is worth less as an asset, but there are rarely lives on the line. I don't think many architects would be comfortable taking risks with critical structural details. Also, even if a firm isn't found technically liable for a deadly building failure it can still be very bad for business. That said I'm sure some architects still put people's lives at risk to avoid liability. I suspect it's similar any other industry where, sometimes, collectively people in a company put the public at risk for the sake of financial gain - pharmaceutical companies, manufacturers, mining companies, etc. No individual feels personally responsible.

mattkrause 10y ago

> How do we decide when it is negligence, and when there was nothing that could be done? This isn't an insoluble issue: courts deal with similar decisions in car crashes, medical malpractice, and many other scenarios. A plaintiff could argue that the respondent should have been aware of certain vulnerabilities because they were widely disseminated, or that certain practices are explicitly warned against in common training materials. Respondents might counter by arguing that they test for that type of vulnerability using a widely-accepted tool, but it failed to flag this one issue, or something like that. I agree that it can't be a purely algorithmic process, but almost nothing in a courtroom is.

ahartman00 10y ago
Very true, but courts arent known for being up to date with tech.
- josephg 10y ago
  Courts aren't up to date on medicine either, but they manage to preside over malpractice cases somehow. I'm sure if technical malpractice graced their courtrooms regularly they would manage somehow. Probably by relying on expert witnesses and learn the bits and pieces of jargon they need to know.

CaptSpify 10y ago

Do you regularly hire contractors and then never look over the work they do? Because I don't, and frankly, that's kind of idiotic. The data is your responsibility, not theirs. They also have no interest in the longevity of your company, why would you trust them without checking what they are doing? As a customer, I don't care how Home-Depot handed out my CC info, I care that they did. Sure some hacks happened despite companies putting forth their best effort, but hand-waving the responsibility to contractors is not the answer.

ahartman00 10y ago
"Do you regularly hire contractors and then never look over the work they do?" I dont when it comes to software. For say legal services, I dont have many options, as I am not an expert. The point I was trying to make is that sometimes people hire contractors because they dont have the expertise. How are they supposed to review something they dont understand? Saying every organization should have top notch IT on staff so this doesnt happen is hand-waving as well.
- CaptSpify 10y ago
  There's a famous saying along the lines of "If you are rich, hire two accountants. One to keep track of your books, and another to keep track of the first guy" If you provide sensitive information to anyone that you don't have legal recourse against, then I don't really have any sympathy for you. If you make a bad business decision and it leaks my info, I'm not upset because someone took it without your approval, I'm upset because it was leaked. There's a cost/benefit risk to everything. If you want to take the route of working with contractors, you have to weight the risks for that as well.
  - ahartman00 10y ago
    "If you are rich, hire two accountants. One to keep track of your books, and another to keep track of the first guy" Brilliant, I hadnt heard of/thought of that. "There's a cost/benefit risk to everything. If you want to take the route of working with contractors, you have to weight the risks for that as well." True, I would just like to point out that hiring your own staff might no work out either...

krupan 10y ago

I think I'm with Cory on this. It's negligence if you leak it. Period. Nobody is obligated to hoard and store a bunch of sensitive personal data from their customers.

ahartman00 10y ago
In the specific hacks I was thinking of, they didnt hoard and store any info. Equipment was installed that siphoned credit card info from their payment systems. I cant think of a way to run a store without passing credit card info through your payment processing system to the banks.
- krupan 10y ago
  Agreed, credit cards are a ridiculous necessity. I think in this case the credit card companies should be liable. I am continually amazed by the simple solution bitcoin provides to this problem: instead of me giving you an account number that you (or anyone who gets the number) pull(s) money from, you give me a number that I push money to. It's going to be a long time before that kind of change in our payment systems (from pull to push, whether with bitcoin or some other system) can be widely implemented.
  - ahartman00 10y ago
    "I think in this case the credit card companies should be liable." Maybe? I didnt see anything about home depot suing the contractors? Really, they should be held financially and criminally liable.(if they werent) The public ledger part of bitcoin is great also. You can see where the stolen money went. Maybe if they added a way to flag money, so spending stolen bitcoin would trigger an alert at the merchant, the same way canceled credit cards do now.
    - krupan 10y ago
      re: the contractors being liable, currently the way things work is, when my credit card is used fraudulently the credit card company owns that and pays me back, which is the least they could do. I don't even know if they attempt to work with law enforcement to catch the actual fraudsters, but I sure hope they do. Maybe I should be more proactive about that? I don't know. EDIT: I should point out I don't know any details about the Home Depot "hack" and I might not be addressing all the pertinent points of that particular incident. Bottom line is still the same, it shouldn't be the customers who suffer when this happens. The people that made it so easy for my personal information to leak, the ones who necessitated that my personal information even be required as part of the transaction, should be the ones feeling the pain.

flukus 10y ago

> there were also credit card hacks/leaks(and an nsa leak) that were the result of malicious contractors. Wouldn't the negligence just be that they had access to the unencrypted credit card numbers?

ahartman00 10y ago
Ok, so I was confusing the home depot hack mentioned in the article with the target hack, but I dont want to edit my comment after so much discussion. I also want to point out that i was trying to show an exception, not to say that noone should ever be held accountable for a breach. In the target hack, hvac contractors had their credentials stolen, and malware was installed on their pos system. The home depot hack was malware suspected to have been installed on their self checkout machines[1]. So no, they never allowed anyone access to the unencrypted credit card numbers. Negligence is failure to exercise reasonable care.[2] Bad things happen, and even more so when sophisticated criminals are attacking you. It is impossible to create a fully hack proof system. I would say allowing a sql injection is negligence, but when people are using sohpisticated attacks, there is nothing you can do. 1. http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impacted-malware-contained/#more-27975 http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impa... 2. https://en.wikipedia.org/wiki/Negligence https://en.wikipedia.org/wiki/Negligence

skewart 10y ago

> How do we decide when it is negligence, and when there was nothing that could be done? As others have pointed out, that question is one that courts deal with every day in other industries. IANAL but I have some familiarity with the architecture and construction industry, where there are lots of lawsuits around negligence. My understanding is that the question is generally framed as "what would a reasonable professional have done in this case?" Would any reasonable contractor have interpreted those drawings to mean the joists should be spaced 24" apart? Or would a reasonable professional have interpreted it to be 20"? The same standard could be applied to software engineering and data breaches. Would a reasonable engineer allow a SQL injection vulnerability to persist in 2016? I suspect as soon as any amount of precedent is set for lawsuits around "hacking" law firms will push open the floodgates and it will suddenly become very common. In the construction industry the frequency of lawsuits has created a culture where people go to great lengths to reduce their risk of liability. Architects draw deliberately vague details around waterproofing and contractors push to have every detail for how to do things spelled out on paper, so they won't be on the hook if one of the steps in the process is wrong.

sooheon 10y ago
How do architects get away with vague details when lives can be on the line? If they design the building correctly, they should be pushing to make things as explicit as possible so that when contractors make a mistake it is clear where the fault is. It seems unprofessional that they'd be pushing in the other direction.
- skewart 10y ago
  For context, the majority of lawsuits in construction involve defects that are far from life threatening. Waterproofing, insulation, or, say, windows not working quite right are more common. There could be millions of dollars at stake because a defective building is worth less as an asset, but there are rarely lives on the line. I don't think many architects would be comfortable taking risks with critical structural details. Also, even if a firm isn't found technically liable for a deadly building failure it can still be very bad for business. That said I'm sure some architects still put people's lives at risk to avoid liability. I suspect it's similar any other industry where, sometimes, collectively people in a company put the public at risk for the sake of financial gain - pharmaceutical companies, manufacturers, mining companies, etc. No individual feels personally responsible.