5 ms·

Time for criminal penalties for the management team. A breach like this will affect thousands of people monetarily and suck time from them they could have used

by pgrote 9y ago

Time for criminal penalties for the management team. A breach like this will affect thousands of people monetarily and suck time from them they could have used elsewhere. If you've ever dealt with something like this, you know the hours it takes to rectify the damage. The only way corporations will learn to appreciate data security is when management teams suffer criminal penalties.

bmon 9y ago
I don't think it's fair to be throwing any individuals under the bus like that. There's obviously been several failures at multiple levels but the company as a whole will have to face the consequences, not just a few managers it decides to use as scapegoats.
- aidos 9y ago
  Well, except for this: "Three Equifax Inc. senior executives sold shares worth almost $1.8 million in the days after the company discovered a security breach that may have compromised information on about 143 million U.S. consumers." https://www.bloomberg.com/news/articles/2017-09-07/three-equifax-executives-sold-stock-before-revealing-cyber-hack https://www.bloomberg.com/news/articles/2017-09-07/three-equ...
  - scott00 9y ago
    Hah, that's actually excellent news for those hoping for criminal consequences. It might be hard to put anybody in jail for their security negligence, but to me it looks like those three have served themselves up on a platter for an insider trading conviction.
- notyourday 9y ago
  > I don't think it's fair to be throwing any individuals under the bus like that. There's obviously been several failures at multiple levels but the company as a whole will have to face the consequences, not just a few managers it decides to use as scapegoats. Why not?
- tripzilch 9y ago
  How about a lot of managers, then?
elihu 9y ago
We don't know how the security breach happened. Should Equifax be criminally liable for using software which contains a remote-exploitable buffer overflow vulnerability? Or for the actions of a corrupt employee who stole some data and sold it on the black market? It's possible that Equifax did something really negligent and if so maybe there should be a class-action lawsuit against the company. But it's also possible they did all the things they should have done and still failed because security is really hard and maybe the attacker got lucky.
- CaptSpify 9y ago
  Isn't the traditional capitalistic argument that the people on top are the ones taking all the risk, which is why they should be making all of that money in the first place? Note that I'm not making that argument, but trying to understand how this situation differs.
  - dx034 9y ago
    You take a lot of the risk but not all. If this was due to weaknesses in their IT then managers should be liable. But it's possible that they had one of the most secure systems in finance and still someone found a way in via undisclosed exploits. In that case there's nothing a manager could've done. But since the core database wasn't hacked, it seems likely that someone had a database dump on a development machine which was outside the scope..

by pgrote 9y ago

bmon 9y ago

I don't think it's fair to be throwing any individuals under the bus like that. There's obviously been several failures at multiple levels but the company as a whole will have to face the consequences, not just a few managers it decides to use as scapegoats.

aidos 9y ago
Well, except for this: "Three Equifax Inc. senior executives sold shares worth almost $1.8 million in the days after the company discovered a security breach that may have compromised information on about 143 million U.S. consumers." https://www.bloomberg.com/news/articles/2017-09-07/three-equifax-executives-sold-stock-before-revealing-cyber-hack https://www.bloomberg.com/news/articles/2017-09-07/three-equ...
- scott00 9y ago
  Hah, that's actually excellent news for those hoping for criminal consequences. It might be hard to put anybody in jail for their security negligence, but to me it looks like those three have served themselves up on a platter for an insider trading conviction.
notyourday 9y ago
> I don't think it's fair to be throwing any individuals under the bus like that. There's obviously been several failures at multiple levels but the company as a whole will have to face the consequences, not just a few managers it decides to use as scapegoats. Why not?
tripzilch 9y ago
How about a lot of managers, then?

elihu 9y ago

We don't know how the security breach happened. Should Equifax be criminally liable for using software which contains a remote-exploitable buffer overflow vulnerability? Or for the actions of a corrupt employee who stole some data and sold it on the black market? It's possible that Equifax did something really negligent and if so maybe there should be a class-action lawsuit against the company. But it's also possible they did all the things they should have done and still failed because security is really hard and maybe the attacker got lucky.

CaptSpify 9y ago
Isn't the traditional capitalistic argument that the people on top are the ones taking all the risk, which is why they should be making all of that money in the first place? Note that I'm not making that argument, but trying to understand how this situation differs.
- dx034 9y ago
  You take a lot of the risk but not all. If this was due to weaknesses in their IT then managers should be liable. But it's possible that they had one of the most secure systems in finance and still someone found a way in via undisclosed exploits. In that case there's nothing a manager could've done. But since the core database wasn't hacked, it seems likely that someone had a database dump on a development machine which was outside the scope..