7 ms·

One benefit of these incidents at Yahoo! is that they represent salient, clear examples of the cost of poor information security. CIOs and security directors wi

by bmh100 10y ago

One benefit of these incidents at Yahoo! is that they represent salient, clear examples of the cost of poor information security. CIOs and security directors will be able to point to this deal as evidence that poor security can have material impact on the business and destroy massive shareholder value, even years after the fact. A 6.5% intra-day dip sends a clear message. Even a CFO can now see that information security should be viewed as vital insurance that directly impacts shareholder value.

DoctorNick 10y ago
Currently, Yahoo's only raison d'etre is to serve as a warning to others.
- dhimes 10y ago
  I remember this as a "Demotivational" poster, with a picture of the Titanic....
65827 10y ago
Yeah I mean the cost has always been there but this is the first time I recall lots of media coverage around the reality that incidents like this can cost billions, seems like it's finally sinking in.
- Swizec 10y ago
  I wonder how much this is influenced by shows like Mr. Robot where the entire plot revolves around infosec bringing down the world's massivest corporation. Of course Mr. Robot could itself be a symptom of the zeitgeist.
  - jack9 10y ago
    I don't think many people understand what computer security means either way and to get a qualitative answer, you need to know about almost every aspect of development AT A PROJECT LEVEL. what is a potential buyer going to ask, "how's your computer security?" - "it's great, ok"
spoinkaroo 10y ago
The yahoo dip is even larger, considering yahoo's stock is primarily Alibaba. If it were split into two companies the dip would likely be >20%.
- evanelias 10y ago
  True, but BABA is also down 2.5% today on its own, probably due to concerns about the impact of rising US interest rates on China's economy and debt. Drops in BABA's share price tend to be mirrored in YHOO's, so that's responsible for a decent portion (albeit less than half) of today's dip.
- nostrademons 10y ago
  Other sources [1] estimate the impact on Yahoo's core business, after subtracting out Alibaba's stock movements, at about $1.3B. On a $4.8B deal, that's about 27%. [1] https://www.bloomberg.com/gadfly/articles/2016-12-15/yahoo-s-cyberfail-could-cut-1-billion-from-verizon-deal https://www.bloomberg.com/gadfly/articles/2016-12-15/yahoo-s...
  - dmurray 10y ago
    Other sources [0] say Yahoo's core business is negatively valued. How much worse could this make it? [0]http://www.investopedia.com/stock-analysis/070215/why-yahoos-core-business-negatively-valued-baba-yhoo-goog-amzn-fb.aspx http://www.investopedia.com/stock-analysis/070215/why-yahoos... from April, but the prices haven't moved too much since.
    - nostrademons 10y ago
      If buying IP means that you're buying a codebase so full of security holes that it'll likely result in a billion dollars worth of lawsuits in the future, a billion dollar drop in valuation is rational even if the existing valuation is negative.
    - eropple 10y ago
      Consider how one sometimes says "the chairs in the building are valued higher than the stock"--like, it's so low that the actual stuff they have is worth more than that even after liabilities. Now light the chairs on fire. It can get worse.
mtgx 10y ago
Not giving the NSA root access to your servers and to everyone's data should also help.
- godzillabrennus 10y ago
  To be fair it's a post Snowden world and it's clear everyone is doing this. Amazon, Google, Microsoft, Apple, and everyone else who operates in the USA are giving the NSA everything. If you care about your data you are basically only able to secure it if you host it yourself.
  - sasas 10y ago
    or how about ... "if you care about your data, don't put it on the Internet. If you do, use E2E encryption." It's important that people also don't fall into the illusion that their Infosec skills can match that of google/apple engineers. These guys are some of the best there is.
    - _audakel 10y ago
      no matter how good you are, if someone (NSA) got their hands on your hardware at the source there is not much you can do.
  - deleted 10y ago
    [deleted]
  - fooey 10y ago
    Even then, if you're a big enough target, how confident can you be that Dell or Cisco or Intel or AT&T or Seagate aren't giving them a backdoor into your operation anyways? It's pretty revolting, but my assumption is that if the US government _really_ wants your data, it's virtually impossible to block all the vectors they have to get at it.
- lern_too_spel 10y ago
  Who gave the NSA root access to their servers?
at-fates-hands 10y ago
>> they represent salient, clear examples of the cost of poor information security. I'm seriously flabbergasted that they continue to let this happen. The last time you would've thought head would roll, they would batten down the hatches, notify users and be completely proactive in defending against another attack. To me, it looks like they just said, "Well, fuck it, it won't happen again, why invest the time and money to protect our users?" I'd also point out the breech they're referencing was from 2013 so any data that was pilfered has already been running wild on the underground and been passed around a few thousand times. Another reason it just shows they don't care at all. After this, no investor should touch this company with a ten foot pole.
- luhn 10y ago
  As you mentioned, this breach is from 2013, so no matter how much they've stepped up their infosec game since the last breach the damage was already done. The delay in them discovering the breach isn't that alarming either. If you didn't have systems in place to detect an intrusion, how do you retroactively find one? Companies usually don't find out until law enforcement contacts them or they accidentally stumble across the backdoor. So, does Yahoo still have poor infosec? I'd guess so. But this newest breach isn't evidence of that, it only shows how bad their security was in 2013.
ChuckMcM 10y ago
This is a really important point. Yahoo!'s troubles help make a quantitative point to people who care only about money. Having been in the role of advocating investing in security the typical questions are; * "Will the product run faster?", * "Will the customers get better service?", * "Will someone choose us over a competitor because of this?" Generally 'no', 'no', and 'hard to quantify' so the answer to the funding request is "Sorry, not at this time." But if you can say, "When you try to sell this company to another company, the strong security policies and technology this funding will provide insurance against having a security breach like Yahoo! and tanking the sales price." Now that resonates because they probably have a lot to win or lose over the sales price of the company in a merger/acquisition strategy. "Its a few million now, but without it, it could cost you billions of personal wealth down the road. Now who's in?"
- user5994461 10y ago
  Don't quantify security. Just do it. If people ask, just doing my day job' edit: care to explain the downvotes?
  - themoat 10y ago
    I didn't down vote but lots of devs don't have that sweet luxury to not be held accountable for what they're working on in quantitative business terms.
    - ohyeshedid 10y ago
      Nor access to all the code for the entire backend.
  - 6nf 10y ago
    Sometimes it's better to ask forgiveness afterwards than to ask for permission beforehand.
- enraged_camel 10y ago
  Isn't the answer to "will the customer get better service" a definitive "yes"? I mean, obviously it depends on the UX of said security feature(s), but generally speaking, more secure == better. Right?
cmurf 10y ago
The stock price is a paper loss, it means nothing if Yahoo is acquired for the full purchase price Verizon asked for. So it remains to be seen if there's any meaningful punishment by the market for these kinds of breaches. Even if 6.5% stands, it's basically saying the per user value/cost of the breach is about a quarter (as in the coin).
- dmurray 10y ago
  The article is about Verizon threatening to pull out of the deal, or use the breach as leverage to secure a lower price. The market thinks that may happen, hence the fall in price. Even if Verizon end up paying the full price, the fact that investors really worried that they wouldn't is enough to share future companies.
jmquigs 10y ago
On the flip side, it could also convince executives that they need to cover up security breaches as much as possible.
jeffdavis 10y ago
That's a part of it, but we've seen other examples like Target, without a lot of real change. The problem is that it's hard to evaluate security. Unless you know the area very well, it's hard to hire someone that knows the area well, which is a catch-22. Do we know that Yahoo skimped on security, or did they just not get what they paid for because they didn't know better?

by bmh100 10y ago

DoctorNick 10y ago

Currently, Yahoo's only raison d'etre is to serve as a warning to others.

dhimes 10y ago
I remember this as a "Demotivational" poster, with a picture of the Titanic....

65827 10y ago

Yeah I mean the cost has always been there but this is the first time I recall lots of media coverage around the reality that incidents like this can cost billions, seems like it's finally sinking in.

Swizec 10y ago
I wonder how much this is influenced by shows like Mr. Robot where the entire plot revolves around infosec bringing down the world's massivest corporation. Of course Mr. Robot could itself be a symptom of the zeitgeist.
- jack9 10y ago
  I don't think many people understand what computer security means either way and to get a qualitative answer, you need to know about almost every aspect of development AT A PROJECT LEVEL. what is a potential buyer going to ask, "how's your computer security?" - "it's great, ok"

spoinkaroo 10y ago

The yahoo dip is even larger, considering yahoo's stock is primarily Alibaba. If it were split into two companies the dip would likely be >20%.

evanelias 10y ago
True, but BABA is also down 2.5% today on its own, probably due to concerns about the impact of rising US interest rates on China's economy and debt. Drops in BABA's share price tend to be mirrored in YHOO's, so that's responsible for a decent portion (albeit less than half) of today's dip.
nostrademons 10y ago
Other sources [1] estimate the impact on Yahoo's core business, after subtracting out Alibaba's stock movements, at about $1.3B. On a $4.8B deal, that's about 27%. [1] https://www.bloomberg.com/gadfly/articles/2016-12-15/yahoo-s-cyberfail-could-cut-1-billion-from-verizon-deal https://www.bloomberg.com/gadfly/articles/2016-12-15/yahoo-s...
- dmurray 10y ago
  Other sources [0] say Yahoo's core business is negatively valued. How much worse could this make it? [0]http://www.investopedia.com/stock-analysis/070215/why-yahoos-core-business-negatively-valued-baba-yhoo-goog-amzn-fb.aspx http://www.investopedia.com/stock-analysis/070215/why-yahoos... from April, but the prices haven't moved too much since.
  - nostrademons 10y ago
    If buying IP means that you're buying a codebase so full of security holes that it'll likely result in a billion dollars worth of lawsuits in the future, a billion dollar drop in valuation is rational even if the existing valuation is negative.
  - eropple 10y ago
    Consider how one sometimes says "the chairs in the building are valued higher than the stock"--like, it's so low that the actual stuff they have is worth more than that even after liabilities. Now light the chairs on fire. It can get worse.

mtgx 10y ago

Not giving the NSA root access to your servers and to everyone's data should also help.

godzillabrennus 10y ago
To be fair it's a post Snowden world and it's clear everyone is doing this. Amazon, Google, Microsoft, Apple, and everyone else who operates in the USA are giving the NSA everything. If you care about your data you are basically only able to secure it if you host it yourself.
- sasas 10y ago
  or how about ... "if you care about your data, don't put it on the Internet. If you do, use E2E encryption." It's important that people also don't fall into the illusion that their Infosec skills can match that of google/apple engineers. These guys are some of the best there is.
  - _audakel 10y ago
    no matter how good you are, if someone (NSA) got their hands on your hardware at the source there is not much you can do.
- deleted 10y ago
  [deleted]
- fooey 10y ago
  Even then, if you're a big enough target, how confident can you be that Dell or Cisco or Intel or AT&T or Seagate aren't giving them a backdoor into your operation anyways? It's pretty revolting, but my assumption is that if the US government _really_ wants your data, it's virtually impossible to block all the vectors they have to get at it.
lern_too_spel 10y ago
Who gave the NSA root access to their servers?

at-fates-hands 10y ago

>> they represent salient, clear examples of the cost of poor information security. I'm seriously flabbergasted that they continue to let this happen. The last time you would've thought head would roll, they would batten down the hatches, notify users and be completely proactive in defending against another attack. To me, it looks like they just said, "Well, fuck it, it won't happen again, why invest the time and money to protect our users?" I'd also point out the breech they're referencing was from 2013 so any data that was pilfered has already been running wild on the underground and been passed around a few thousand times. Another reason it just shows they don't care at all. After this, no investor should touch this company with a ten foot pole.

luhn 10y ago
As you mentioned, this breach is from 2013, so no matter how much they've stepped up their infosec game since the last breach the damage was already done. The delay in them discovering the breach isn't that alarming either. If you didn't have systems in place to detect an intrusion, how do you retroactively find one? Companies usually don't find out until law enforcement contacts them or they accidentally stumble across the backdoor. So, does Yahoo still have poor infosec? I'd guess so. But this newest breach isn't evidence of that, it only shows how bad their security was in 2013.

ChuckMcM 10y ago

This is a really important point. Yahoo!'s troubles help make a quantitative point to people who care only about money. Having been in the role of advocating investing in security the typical questions are; * "Will the product run faster?", * "Will the customers get better service?", * "Will someone choose us over a competitor because of this?" Generally 'no', 'no', and 'hard to quantify' so the answer to the funding request is "Sorry, not at this time." But if you can say, "When you try to sell this company to another company, the strong security policies and technology this funding will provide insurance against having a security breach like Yahoo! and tanking the sales price." Now that resonates because they probably have a lot to win or lose over the sales price of the company in a merger/acquisition strategy. "Its a few million now, but without it, it could cost you billions of personal wealth down the road. Now who's in?"

user5994461 10y ago
Don't quantify security. Just do it. If people ask, just doing my day job' edit: care to explain the downvotes?
- themoat 10y ago
  I didn't down vote but lots of devs don't have that sweet luxury to not be held accountable for what they're working on in quantitative business terms.
  - ohyeshedid 10y ago
    Nor access to all the code for the entire backend.
- 6nf 10y ago
  Sometimes it's better to ask forgiveness afterwards than to ask for permission beforehand.
enraged_camel 10y ago
Isn't the answer to "will the customer get better service" a definitive "yes"? I mean, obviously it depends on the UX of said security feature(s), but generally speaking, more secure == better. Right?

cmurf 10y ago

The stock price is a paper loss, it means nothing if Yahoo is acquired for the full purchase price Verizon asked for. So it remains to be seen if there's any meaningful punishment by the market for these kinds of breaches. Even if 6.5% stands, it's basically saying the per user value/cost of the breach is about a quarter (as in the coin).

dmurray 10y ago
The article is about Verizon threatening to pull out of the deal, or use the breach as leverage to secure a lower price. The market thinks that may happen, hence the fall in price. Even if Verizon end up paying the full price, the fact that investors really worried that they wouldn't is enough to share future companies.

jmquigs 10y ago

On the flip side, it could also convince executives that they need to cover up security breaches as much as possible.

jeffdavis 10y ago

That's a part of it, but we've seen other examples like Target, without a lot of real change. The problem is that it's hard to evaluate security. Unless you know the area very well, it's hard to hire someone that knows the area well, which is a catch-22. Do we know that Yahoo skimped on security, or did they just not get what they paid for because they didn't know better?