3 ms·
Can't blame you for being hacked, but how can security be "core to who we are" if it took 6 months to discover a breach?
by markdown 10y ago
Can't blame you for being hacked, but how can security be "core to who we are" if it took 6 months to discover a breach?
- bigtones 10y agoThey did not discover the breach, it was reported to them.
- mordocai 10y agoDiscovering a breach is arguably the hardest part.
- tptacek 10y agoYou're describing basically every breach ever.
- dsacco 10y agoIn a perfect world companies would recognize and react to security breaches almost as soon as they happen. But if you have ever managed the logging pipeline or incident response practice for a company, you understand that this is deeply unrealistic. There is virtually no company which discovers that it has been breached within a short period of time - the nature of a security breach is such that it doesn't generally become apparent until some time later. This pattern continually plays itself out with just about every large breach you can think of. In that respect, considering Weebly actually hashed their passwords with bcrypt and is reacting to the breach in the same year, they're fairly far ahead of the curve on this one.
- user5994461 10y agoFYI: The median time to discover a breach is "infinite". 6 months is much better than the median :D