3 ms·

If they had an outside security firm helping them starting in March, and another breach in July, that doesn't say much for the capabilities and competency of th

If they had an outside security firm helping them starting in March, and another breach in July, that doesn't say much for the capabilities and competency of the security firm.

valas 9y ago
It's quite possible the security firm was asked to audit their systems, but not asked (or paid) to fix them.
- 086421357909764 9y ago
  A lot of people want you to come in and find a quick answer and fix, rarely allowing a full proper investigation. Many times they're adverse to spending money and want to cut corners where they can. It's actually disheartening. Much like one of the posters above, I've seen people purposely stop investigations because if the investigation reported on known issues it would open up more questions about other wrong doings. The Irony is their actions on remediation are almost exactly in line with the decisions made that often times lead to the incident. It's cyclical.
  - chii 9y ago
    So you can't do this with accounting audit, so laws should be updated to make security audits the same!
    - ams6110 9y ago
      I suppose the difference is that in accounting, any irregularities or shennanigans are quantifiable in dollars. Security breaches maybe sometimes are, but often are not. I'm guessing there nobody able to prove that his or her identity was stolen as a result of this breach, to say nothing of being able to specify a dollar amount of loss that can be backed up. With often vague or only theoretical damages, it's harder to muster support for draconian consequences. Also people can sort of understand accounting. Dollars and cents and balances are something most people can comprehend. Computer software and security breaches, on the other hand, are much more of a black box for most people. They can't intuitively understand what's sensisible and reasonable and what would constitute negligence when it comes to protecting software sytems and data, other than by relying on what other people tell them.
qaq 9y ago
I am not sure about origins, but the name they disclosed in their PR is of a very capable outfit.
- ams6110 9y ago
  If that's the case, we must assume then that any recommendations they made were summarily ignored, given the subsequent breach in July?
  - travmatt 9y ago
    You also have to look at the scope of the work performed too, wouldn't you?
    - ams6110 9y ago
      Hard to imagine a competent security review would not point out "Your entire database is accessible directly from the web server and you have no verified plan or demonstrated capability to deploy security patches to the web server within a reasonable timeframe"
  - qaq 9y ago
    They did not disclose details of the engagement so hard to speculate on anything. It somewhat unusual for the name to be disclosed though.
    - kitotik 9y ago
      That caught my eye as well. It would not be a bad strategy at all to leak the names of as many potential scapegoats as possible if one were avoiding accountability.
otakucode 9y ago
Not 'helping them', just diagnosing a breach. Part of their due diligence to make sure they don't run afoul of the reporting laws. Once it was determined they didn't have proof of data leaving the network, I imagine they booted that security company immediately. They're not going to spend money to improve their security just because a non-reportable breach occurred. They don't give a shit about your data.

If they had an outside security firm helping them starting in March, and another breach in July, that doesn't say much for the capabilities and competency of the security firm.

valas 9y ago

It's quite possible the security firm was asked to audit their systems, but not asked (or paid) to fix them.

086421357909764 9y ago
A lot of people want you to come in and find a quick answer and fix, rarely allowing a full proper investigation. Many times they're adverse to spending money and want to cut corners where they can. It's actually disheartening. Much like one of the posters above, I've seen people purposely stop investigations because if the investigation reported on known issues it would open up more questions about other wrong doings. The Irony is their actions on remediation are almost exactly in line with the decisions made that often times lead to the incident. It's cyclical.
- chii 9y ago
  So you can't do this with accounting audit, so laws should be updated to make security audits the same!
  - ams6110 9y ago
    I suppose the difference is that in accounting, any irregularities or shennanigans are quantifiable in dollars. Security breaches maybe sometimes are, but often are not. I'm guessing there nobody able to prove that his or her identity was stolen as a result of this breach, to say nothing of being able to specify a dollar amount of loss that can be backed up. With often vague or only theoretical damages, it's harder to muster support for draconian consequences. Also people can sort of understand accounting. Dollars and cents and balances are something most people can comprehend. Computer software and security breaches, on the other hand, are much more of a black box for most people. They can't intuitively understand what's sensisible and reasonable and what would constitute negligence when it comes to protecting software sytems and data, other than by relying on what other people tell them.

qaq 9y ago

I am not sure about origins, but the name they disclosed in their PR is of a very capable outfit.

ams6110 9y ago
If that's the case, we must assume then that any recommendations they made were summarily ignored, given the subsequent breach in July?
- travmatt 9y ago
  You also have to look at the scope of the work performed too, wouldn't you?
  - ams6110 9y ago
    Hard to imagine a competent security review would not point out "Your entire database is accessible directly from the web server and you have no verified plan or demonstrated capability to deploy security patches to the web server within a reasonable timeframe"
- qaq 9y ago
  They did not disclose details of the engagement so hard to speculate on anything. It somewhat unusual for the name to be disclosed though.
  - kitotik 9y ago
    That caught my eye as well. It would not be a bad strategy at all to leak the names of as many potential scapegoats as possible if one were avoiding accountability.

otakucode 9y ago

Not 'helping them', just diagnosing a breach. Part of their due diligence to make sure they don't run afoul of the reporting laws. Once it was determined they didn't have proof of data leaving the network, I imagine they booted that security company immediately. They're not going to spend money to improve their security just because a non-reportable breach occurred. They don't give a shit about your data.