4 ms·

> One possible explanation, according to several veteran security experts consulted by Bloomberg, is that the investigation didn’t uncover evidence that data wa

by orf 9y ago

> One possible explanation, according to several veteran security experts consulted by Bloomberg, is that the investigation didn’t uncover evidence that data was accessed. Most data breach disclosure laws kick in only once there’s evidence that sensitive personal identifying information like social security numbers and birth dates have been taken. There was one company (very well known) I know of that was breached, but their logging and general security infrastructure was so poor that they had no direct evidence that customer info was breached, so they didn't have to report the hack. They only found the intrusion due to excessive load the intruders caused on some services. Customer info was certainly accessed (the attackers where everywhere), it's just there was no record of it as the records they kept where so few and far between. Part of me thinks it's a pretty clever workaround to such laws.

KGIII 9y ago
Between this and them lobbying for no-fault for data exfiltration, it keeps getting better and better. My credit has been locked since the OPM fiasco, I'd like to recommend others consider it.
086421357909764 9y ago
I worked on a breach where during the investigation we found reverse tunnels out of the network (back to the VP's house) where he'd been working on stuff unbeknownst to the firm. They had a VPN to a competitor that a sales engineer had setup when they were exploring collaboration, that had never been closed. Their DMZ was awesome on paper (cool color chart) but was literally non-existent. The final icing on the cake, their network equipment and firewalls were all second hand with existing firewall rules left when new ones were added. After printing out the rules.. at the very bottom ANY/ANY. There wasn't a lack of money, hundreds of millions were dumped in by investors. Everyone there had the i'm an engineer so I don't have to follow rules, that's for the sales guys attitude and that more than did them in from a security perspective.
otakucode 9y ago
Sure, that combined with the fact that courts simply refuse to refer to anything involving software a 'negligence', no matter how extravagantly negligent it might be, would make that a pretty good strategy. The only flaw in it, really, is that it would also open you up to things like the Sony hack which actually had them shut down operations for awhile. As much as companies REALLY do not want to ever admit it, no matter what they do, their software IS their business in every sense. Without it in a working state, they have to shut their doors. So I suppose you have to strike a balance... secure enough that things keep working, but not so secure that it actually costs money...
- inlined 9y ago
  Maybe this is the unintended benefit of companies like domino's claiming they're a "tech business that sells pizza". I'd love to see that language used in an agument that the company has made tech it's core competency and that lowers the bar for negligence.
  - dpwm 9y ago
    I imagine it would depend on the nature of negligence: were they to leak customer data, they would be treated as a tech business; were they to poison customers, they would be treated as a pizza business.
    - dx034 9y ago
      The pizza is probably produced by others, in the spirit of the gig economy. That way the company can defend any lawsuit.
travmatt 9y ago
Assuming this service held some type of protected information (i.e., credit card data) I'd assume that such conduct would constitute a negligence of some variety.
TheCondor 9y ago
Sadly, I don't think this is that uncommon. The use of client attorney privilege to protect these secrets also isn't that uncommon.
daveheq 9y ago
If a company finds a breach of sensitive customer data, they need to fix the breach, not wait until they discover a ton of data was lifted... otherwise this seems like prime stupidity, and the fact that they instead just tried to cover it up until they couldn't anymore shows deceit and untrustworthiness.
chirau 9y ago
> There was one company (very well known) I know of that was breached, ... cough cough Yahoo!

by orf 9y ago

KGIII 9y ago

Between this and them lobbying for no-fault for data exfiltration, it keeps getting better and better. My credit has been locked since the OPM fiasco, I'd like to recommend others consider it.

086421357909764 9y ago

I worked on a breach where during the investigation we found reverse tunnels out of the network (back to the VP's house) where he'd been working on stuff unbeknownst to the firm. They had a VPN to a competitor that a sales engineer had setup when they were exploring collaboration, that had never been closed. Their DMZ was awesome on paper (cool color chart) but was literally non-existent. The final icing on the cake, their network equipment and firewalls were all second hand with existing firewall rules left when new ones were added. After printing out the rules.. at the very bottom ANY/ANY. There wasn't a lack of money, hundreds of millions were dumped in by investors. Everyone there had the i'm an engineer so I don't have to follow rules, that's for the sales guys attitude and that more than did them in from a security perspective.

otakucode 9y ago

Sure, that combined with the fact that courts simply refuse to refer to anything involving software a 'negligence', no matter how extravagantly negligent it might be, would make that a pretty good strategy. The only flaw in it, really, is that it would also open you up to things like the Sony hack which actually had them shut down operations for awhile. As much as companies REALLY do not want to ever admit it, no matter what they do, their software IS their business in every sense. Without it in a working state, they have to shut their doors. So I suppose you have to strike a balance... secure enough that things keep working, but not so secure that it actually costs money...

inlined 9y ago
Maybe this is the unintended benefit of companies like domino's claiming they're a "tech business that sells pizza". I'd love to see that language used in an agument that the company has made tech it's core competency and that lowers the bar for negligence.
- dpwm 9y ago
  I imagine it would depend on the nature of negligence: were they to leak customer data, they would be treated as a tech business; were they to poison customers, they would be treated as a pizza business.
  - dx034 9y ago
    The pizza is probably produced by others, in the spirit of the gig economy. That way the company can defend any lawsuit.

travmatt 9y ago

Assuming this service held some type of protected information (i.e., credit card data) I'd assume that such conduct would constitute a negligence of some variety.

TheCondor 9y ago

Sadly, I don't think this is that uncommon. The use of client attorney privilege to protect these secrets also isn't that uncommon.

daveheq 9y ago

If a company finds a breach of sensitive customer data, they need to fix the breach, not wait until they discover a ton of data was lifted... otherwise this seems like prime stupidity, and the fact that they instead just tried to cover it up until they couldn't anymore shows deceit and untrustworthiness.

chirau 9y ago

> There was one company (very well known) I know of that was breached, ... cough cough Yahoo!