3 ms·
If that new product exposes scads of private data, then it's rather irrelevant. These credit scores aren't something most people signed up for, they are a produ
by chris_wot 9y ago
If that new product exposes scads of private data, then it's rather irrelevant. These credit scores aren't something most people signed up for, they are a product for financial lenders and not for the direct consumer.
- tptacek 9y agoLike I said, the fact of the tradeoff probably does have implications for how we regulate companies like Equifax.
- Drdrdrq 9y agoSorry, I have to disagree. Performing regular pen testing is costly, so skiping it is a tradeoff. Employing a team of security engineers is also costly and there aren't enough of them to make that viable for all companies. Tradeoff. But putting such data in direct access of a web server, a single RCE away from exposure? That's not a tradeoff, that's negligence.
- tptacek 9y agoYou've lost me. I think you may have misunderstood my point about pentests. I mean "success" from the perspective of the testers: you asked me to own your network up, and I succeeded. My point is: the most savvy companies contract annual sitewide pentests, in addition to all the other stuff they do to secure their networks, and virtually all of those pentests "succeed" (from the perspective of the testers). Further: not only have I never personally been on an internal network pentest (the kind where you start with an IP "behind the firewall" and nothing else) that failed, but I'm not sure I've even ever heard of one that failed. I'm certain there are some networks that are so resilient that they've stymied a competent internal pentest --- but again, I wouldn't know which one, because I've never heard of that happening.