4 ms·

Not really any details in that post. As a company offering a Cloud IAM I would expect some top notch security and while I understand that doesn't mean they woul

Not really any details in that post. As a company offering a Cloud IAM I would expect some top notch security and while I understand that doesn't mean they would be "hacker proof" I'm surprised they need to go through an independent firm just to figure out the how and the extent of the intrusion. This happened less than a year ago, too! https://www.onelogin.com/blog/august-2016-incident https://www.onelogin.com/blog/august-2016-incident

abrookewood 9y ago
I think the use of an independent firm is supposed to reassure everyone that they are taking it seriously and aren't going to brush it under the carpet. It's the same reason why companies use independent firms to do penetration testing etc, rather than simply stating that these are managed internally.
- BinaryIdiot 9y ago
  Sure and I get doing that in addition to some work internally. But the way this was written gave me the impression that someone broke in, they don't know anything about it and are passing it off to someone else. Maybe that's the wrong impression but with virtually zero details contained within the post regarding the intrusion it certainly doesn't inspire much confidence.
lloydde 9y ago
I'm on mobile and at first mistook the authors bio for the majority of the article.
kbart 9y ago
Hiring an independent firm is an accepted practice to show that nothing is going to be hidden or watered down. If company (especially big one) handles breaches themselves, it usually boils down to trying to save face with bad PR or outright lie.[0] 0. https://en.wikipedia.org/wiki/Adobe_Systems#Customer_data_breach https://en.wikipedia.org/wiki/Adobe_Systems#Customer_data_br...
mifreewil 9y ago
Yup, this combined with the fact the CISO seems to be a business person instead of an actual security expert has me screaming anything but OneLogin. I get the impression this company behaves like a typical mobile app instead of having the strong security practices you would expect from a company like this.

abrookewood 9y ago

I think the use of an independent firm is supposed to reassure everyone that they are taking it seriously and aren't going to brush it under the carpet. It's the same reason why companies use independent firms to do penetration testing etc, rather than simply stating that these are managed internally.

BinaryIdiot 9y ago
Sure and I get doing that in addition to some work internally. But the way this was written gave me the impression that someone broke in, they don't know anything about it and are passing it off to someone else. Maybe that's the wrong impression but with virtually zero details contained within the post regarding the intrusion it certainly doesn't inspire much confidence.

lloydde 9y ago

I'm on mobile and at first mistook the authors bio for the majority of the article.

kbart 9y ago

Hiring an independent firm is an accepted practice to show that nothing is going to be hidden or watered down. If company (especially big one) handles breaches themselves, it usually boils down to trying to save face with bad PR or outright lie.[0] 0. https://en.wikipedia.org/wiki/Adobe_Systems#Customer_data_breach https://en.wikipedia.org/wiki/Adobe_Systems#Customer_data_br...

mifreewil 9y ago

Yup, this combined with the fact the CISO seems to be a business person instead of an actual security expert has me screaming anything but OneLogin. I get the impression this company behaves like a typical mobile app instead of having the strong security practices you would expect from a company like this.