9 ms·

If we start screaming "something must be done!", we'll be very unhappy with what actually gets done. There are so many people who are at least partly to blame

If we start screaming "something must be done!", we'll be very unhappy with what actually gets done. There are so many people who are at least partly to blame when something like this happens. Bob the engineering manager who committed a quick but insecure fix years ago, Shirley the intern who didn't know what she was doing, Joe the manager who hired Bob and Shirley in the first place, Mike the manager at the company supplying third party software that ends up being exploited, etc. The worst outcome is that companies outsource all their IT security and therefore responsibility to companies that disappear as soon as there is a problem. But if we rush too quickly to impose criminal sanctions, that will be the likely outcome. The better solution is to work this one out as a society. Stop relying on things like SSNs and maiden name as "security", and stop building enormous silos of unnecessary data.

Multicomp 9y ago
I agree. It's very difficult to get a government to pass a 'common sense law' given the myriad influences of different alliances, lobbyists, special interests, etc. that seem to corrupt just about any bill that goes before Congress, no matter how well-founded it may be at the very beginning. I'd also much rather have government under-react than over-react. (The former has a lot more flexibility) EDIT: Fixed words
ak217 9y ago
Equifax must be dismantled and driven into bankruptcy. You present a fallacy. No, a rational company with accountability for its data doesn't outsource their IT security or let the intern access production. They take their job seriously and prevent something like this from happening by building security into their architecture. I have worked for companies that recognize they are liable for protecting the data they hold, and that it only takes one breach for trust to be destroyed. We spent countless hours hardening, compartmentalizing, and monitoring our infrastructure. The nihilistic implication that nothing can be done is maddening.
- nevir 9y ago
  Companies that take this sort of thing seriously ALSO have breaches occur. They just do a better job of mitigating them, and messaging them.
  - emidln 9y ago
    Breaches occur. Negligent security, networking, and auditing missed or ignored network segmentation. I can forgive a small company dealing with my email when they lose it. Equifax is't a small company. They didn't just lose my email. They should be disbanded and their CTO, CIO, and CEO should be held personally responsible.
    - bdamm 9y ago
      And Equifax's handling and messaging was truly abysmal. Security professionals are going to write songs about this and pass the knowledge on to their (older) children as scary camp fire stories.
  - 086421357909764 9y ago
    Correct, all companies face breaches, it's the management and response that should determine the course of action. This is where an independent investigation is crucial for determining basic failures vs systemic disregard. The harder part would be weighing it.
  - vkou 9y ago
    Then perhaps the risk of allowing this kind of business - period - is too great.
    - goialoq 9y ago
      The alternative is higher interest rates, reduced unsecured credit, pay-in-advance for housing, and shutting "the masses" out of access to capital.
- blowski 9y ago
  I agree that seeing Equifax go bankrupt over this would be great. But do you honestly believe your data will be safe? All that time you spent hardening your architecture makes it safer, but not 100% safe. If it's hacked because of one mistake that one person made, would it be right to hold you criminally responsible?
  - smaddox 9y ago
    There should be no avenue for single points of failure to result in catastrophic data breach. Neither architecture nor procedures should allow a single person to compromise the system, willingly or accidentally.
  - CaptSpify 9y ago
    If you can't guarantee that the data can be kept safe, then you shouldn't rely your business on it.
- bogomipz 9y ago
  >"Equifax must be dismantled and driven into bankruptcy." I don't disagree with that sentiment but you have to deal with the whole triumvirate - Equifax, Experian and Transunion.
  - Pixeleen 9y ago
    As well as ChexSystems which contains just as must personal data about deposit accounts instead of credit accounts. Also Lexis which collects from a wide range of private sources and has exclusive special arrangements with public sources.
    - bogomipz 9y ago
      I guess I am not as familiar with CheckSystems, is that pay roll data? Does Lexis Nexus collect financial data on individuals? I thought it's focus was research
      - Pixeleen 9y ago
        ChexSystems does not have salary information. They contain information on bank accounts that have been overdrawn, bad checks, and checkbook orders. They also contain information on accounts in good standing, and the usual information like aliases, addresses, SSNs, and driver license numbers. Lexis Nexis long since moved beyond newspaper and courthouse archiving. They have dozens of intelligence products and databases aimed at marketing, debt collection, private investigators, and law enforcement. They collect massive personal consumer (and business) data, including retail purchases and returns, and salaries, and associate it in a Facebook-style graph, loosely associated with SSN and DL#.
        bogomipz 9y ago
        Interesting about both, thanks. I suppose it's just a matter of time before both of these are compromised. In fact is surprising that they haven't. I wonder if this is just because they aren't as well known as the big 3?
- kabdib 9y ago
  I don't disagree, either, but whatever data Equifax has collected would be part of the bankruptcy sale. Equifax needs to wipe its data and all extant backups. Then it can be sold (for maybe ten dollars).
- g051051 9y ago
  Were the companies you worked for dealing with data at the scale of Equifax? Were they under the kind of unceasing attack that the Equifax systems are? Do you think you could have withstood that kind of assault on your systems? All the CRAs endure attacks at a scale that are difficult to comprehend. It's frankly a surprise that something like this hasn't happened before to any one of the big 3.
  - bdamm 9y ago
    It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection. Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available if one happened to know the magic URL. This discovery was made through the process of a pen-test team sharing their findings back to development, who in turn extended their findings based on what developers knew about the system. Forensics done after the discovery revealed no cases of anyone actually finding the magic URL, which was a big relief for the company. So maybe the banks aren't as strong as we think, either. We have quite a few payment breaches to look back to as evidence.
    - g051051 9y ago
      > It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection. Can you cite a source for how we "now know how terribly fast and loose Equifax was operating"? Equifax is a CRA and is treated as a financial institution under the applicable laws, like banks are. > Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available Then you should know better than to simply claim that a company that suffers a breach is somehow inherently incompetent or uncaring about security.
      - grasshopperpurp 9y ago
        > Equifax was negligent to spill all that data, but a business model that requires all that data in one place is itself a form of negligence. - Matt Blaze http://thehill.com/opinion/technology/350197-equifax-breach-a-nightmare-that-should-serve-as-wake-up-call-for-feds http://thehill.com/opinion/technology/350197-equifax-breach-...
- jacquesm 9y ago
  > No, a rational company with accountability for its data doesn't outsource their IT security There are a lot of irrational companies in the world by that standard.
- pmarreck 9y ago
  > The nihilistic implication that nothing can be done is maddening. THIS. And in this case we have blatant evidence of negligence- There is absolutely zero excuse in this day and age to not keep operating systems patched up with security patches. There is no financial excuse, there is no logistical excuse, and given the sensitivity of the data, there is no ethical excuse. Take the responsibility seriously, or please just go off and die in a fire. (Or, if you're an Equifax executive, retire at the height of your incompetence.) Which is why I shamelessly say: Fuck Richard Smith, fuck Equifax, fuck Susan Mauldin, and fuck their entire IT management staff. What the fuck is wrong with you people? Disclaimer: I was recently hacked/had my identity stolen, and although I was fortunate to only have to wait 2 weeks to get back access to everything, I may be a little sore about stuff like this.
criddell 9y ago
In a previous discussion on HN, a pretty convincing argument was made that all the government needs to do is legislate any loss of information that includes a SSN is an automatic $100 penalty per SSN. Companies will need to buy insurance to cover this and the insurers will take care of the rest.
- blowski 9y ago
  Who pays the $100? The parent company or the subsidiary that can go bankrupt, and transfer its assets to another subsidiary for $1?
  - seanmcdirmid 9y ago
    The insurer.
    - deleted 9y ago
      [deleted]
  - criddell 9y ago
    That's not how bankruptcy works. Assets are used to pay debts including legal debts.
  - pyre 9y ago
    Hiding behind bankruptcy only works if the subsidiary has no assets. Patent trolls work this to their advantage by creating a company whose only asset is the patent. If they lose / the patent is invalidated the company's only asset is worthless. They therefore have no assets to pay their debts.
  - dkersten 9y ago
    Hold the directors and/or executive team personally responsible if the company folds without paying?
  - dsfyu404ed 9y ago
    Whichever party the consumer gave the info too. If X gets fined then it's their job to sue someone else if they think that someone else is responsible.
mannykannot 9y ago
The idea that the only possible solution is to start over is unrealistic, unhelpful and also wrong, and is so despite your attempt to caricature anyone thinking otherwise. With proper policies, technical measures can be taken to greatly improve security over the clusterfuck that is Equifax (and probably the other agencies as well.) With proper regulation, the company (and so, indirectly, its shareholders) and its officers could be held responsible, whether or not they choose to outsource the implementation. For a start, every regulation that Equifax was lobbying to be weakened could be strengthened. In the 18th and 19th century, Britain transported many petty criminals to penal colonies in Australia. Putting aside the brutality of that policy, there was at least some concern over the number of deaths on the voyage. After other attempts failed, one simple policy brought about considerable improvement: shipowners were paid by the number of live transportees arriving. They complained mightily that it would not work, but it did. Frankly, your post looks like a self-serving defense of business-as-usual mediocrity in IT.
planar_vector 9y ago
I'd add that the vitriol against Equifax partly arises from everyone's distaste of CRA's (credit reporting agencies) owing to their magic 8 ball scheme of ranking credit. There may also be some reserved anti-sub-prime sentiment that lingers from 2008. At the very least, I hope this will cause lenders and credit reporters to take data security very seriously.
interstitial 9y ago
> If we start screaming "something must be done!", we'll be very unhappy with what actually gets done. I seldom find such wisdom in the hive. But the hive wants something to be done. Legislatures and lobbyist have this twist-o-flex down to a documented science. They love it! What ever the public wants for 30-days, can turn around into an industry wishlist in 6 months when something actually gets on the floor.
alien_at_work 9y ago
>Bob the engineering manager who committed a quick but insecure fix years ago Unacceptable. Software development needs to be treated as engineering. We need to finally rid ourselves of the concept of "quick and dirty". If that means all the people who live off of that style of development leave the industry, fantastic! It would be great if every manager who told his devs "I don't need it to be perfect, it just needs to kind of function and be ready by EOB today" could end up financially liable. >Shirley the intern who didn't know what she was doing What was she doing working on a production system unsupervised? A plumber-in-training may get to work with the pipes on his own a bit but you can be sure the certified plumber will inspect everything before signing off. The IT industry needs a shakeup and if it takes something like this to accomplish it, good.
- pcsanwald 9y ago
  I think it's rarely that straightforward. Think about how all the different ways software evolves: one way is, code is written when the company is first getting going, and before you have users or revenue or any kind of product/market fit, it really makes very little sense to be writing bulletproof code. "Quick and dirty" is a rational decision at the early stages of a company. A small subset of these kinds of systems end up at big companies, because they're acquired, or because the company grows, etc etc. How do you draw a line in the sand where everyone stops the world and re-implements all the "quick and dirty" stuff? I briefly worked in construction and I've seen plenty of "quick and dirty" there, also, particularly in suburban renovations. Time is money in these projects, and corners are often cut. I'm not saying all engineering works this way, clearly building bridges is a different matter, but I am pointing out that there is a spectrum.
  - csydas 9y ago
    > A small subset of these kinds of systems end up at big companies, because they're acquired, or because the company grows, etc etc. How do you draw a line in the sand where everyone stops the world and re-implements all the "quick and dirty" stuff? Quite frankly, it seems like you nailed the point when someone should be re-implementing the quick and dirty stuff; the moment it gets acquired and integrated. I do understand what you're saying, but I cannot agreed that just because something is difficult to do means that one can hand-wave responsibility. In the case of large companies that have been subject to breaches recently, the only reason they get by after the fact is because they can afford to; if it were to happen to any of the small shops running in "Quick and Dirty" mode and something happened, the shop would more or less take a hit it could not recover from. I see this in action and hear the same excuse every single day with my clients, and it doesn't matter if they're a multi-national whose infrastructure spans continents or some dude with a pirated hyper v host in his room, the excuse is always the same: "Oh we had to do it that way, and didn't have time to fix it." Quite frankly, it's non-sense, infinitely moreso in virtual environments. The workflow and technology available for patch-testing, deployment, and rollback has never been faster, safer, or easier than it currently is; companies just aren't doing it, and no one is holding people accountable for negligence. If the aforementioned construction workers who did a quick and dirty job cause major damage to the house as a result, they would be liable for damages due to their negligence. I'm not sure why we in the Tech community somehow think we're above responsibility for our negligence. I understand that money is on the line - I deal with clients where every minute of down-time has a substantial dollar figure attached, and there's always the attitude of "we'll deal with it later"; and yet, this attitude always ends up causing more trouble in the end, and naturally costing far more. Edit: Changed "...responsibility for our own negligence" to remove "own"
zer00eyz 9y ago
Your describing an unfortunate series of events. Were talking about a company who had "admin" as a user name and password on a database with consumer data on it. > The better solution is to work this one out as a society. Stop relying on things like SSNs and maiden name as "security", and stop building enormous silos of unnecessary data. This doesn't stop aggregators from forming, the data has value someone will collect and sell it.
- JumpCrisscross 9y ago
  The only place this issue ends up, if pushed hard enough in the Congress, is mandatory licensing (with fees, of course) for software engineers. Best case: you limit such licensing requirements to certain domains.
mfringel 9y ago
"There's plenty of blame to go around" and its equivalents are semantically null.
eberkund 9y ago
This is only an issue because everyone has the "not my problem, it will never come back to me" attitude. Ideally by the time this case is fully fleshed out the blame will trickle down from the top and many people will be implicated. Either their reputation in the industry being tarnished or contracting companies getting sued by Equifax for making them liable.

Multicomp 9y ago

I agree. It's very difficult to get a government to pass a 'common sense law' given the myriad influences of different alliances, lobbyists, special interests, etc. that seem to corrupt just about any bill that goes before Congress, no matter how well-founded it may be at the very beginning. I'd also much rather have government under-react than over-react. (The former has a lot more flexibility) EDIT: Fixed words

ak217 9y ago

Equifax must be dismantled and driven into bankruptcy. You present a fallacy. No, a rational company with accountability for its data doesn't outsource their IT security or let the intern access production. They take their job seriously and prevent something like this from happening by building security into their architecture. I have worked for companies that recognize they are liable for protecting the data they hold, and that it only takes one breach for trust to be destroyed. We spent countless hours hardening, compartmentalizing, and monitoring our infrastructure. The nihilistic implication that nothing can be done is maddening.

nevir 9y ago
Companies that take this sort of thing seriously ALSO have breaches occur. They just do a better job of mitigating them, and messaging them.
- emidln 9y ago
  Breaches occur. Negligent security, networking, and auditing missed or ignored network segmentation. I can forgive a small company dealing with my email when they lose it. Equifax is't a small company. They didn't just lose my email. They should be disbanded and their CTO, CIO, and CEO should be held personally responsible.
  - bdamm 9y ago
    And Equifax's handling and messaging was truly abysmal. Security professionals are going to write songs about this and pass the knowledge on to their (older) children as scary camp fire stories.
- 086421357909764 9y ago
  Correct, all companies face breaches, it's the management and response that should determine the course of action. This is where an independent investigation is crucial for determining basic failures vs systemic disregard. The harder part would be weighing it.
- vkou 9y ago
  Then perhaps the risk of allowing this kind of business - period - is too great.
  - goialoq 9y ago
    The alternative is higher interest rates, reduced unsecured credit, pay-in-advance for housing, and shutting "the masses" out of access to capital.
blowski 9y ago
I agree that seeing Equifax go bankrupt over this would be great. But do you honestly believe your data will be safe? All that time you spent hardening your architecture makes it safer, but not 100% safe. If it's hacked because of one mistake that one person made, would it be right to hold you criminally responsible?
- smaddox 9y ago
  There should be no avenue for single points of failure to result in catastrophic data breach. Neither architecture nor procedures should allow a single person to compromise the system, willingly or accidentally.
- CaptSpify 9y ago
  If you can't guarantee that the data can be kept safe, then you shouldn't rely your business on it.
bogomipz 9y ago
>"Equifax must be dismantled and driven into bankruptcy." I don't disagree with that sentiment but you have to deal with the whole triumvirate - Equifax, Experian and Transunion.
- Pixeleen 9y ago
  As well as ChexSystems which contains just as must personal data about deposit accounts instead of credit accounts. Also Lexis which collects from a wide range of private sources and has exclusive special arrangements with public sources.
  - bogomipz 9y ago
    I guess I am not as familiar with CheckSystems, is that pay roll data? Does Lexis Nexus collect financial data on individuals? I thought it's focus was research
    - Pixeleen 9y ago
      ChexSystems does not have salary information. They contain information on bank accounts that have been overdrawn, bad checks, and checkbook orders. They also contain information on accounts in good standing, and the usual information like aliases, addresses, SSNs, and driver license numbers. Lexis Nexis long since moved beyond newspaper and courthouse archiving. They have dozens of intelligence products and databases aimed at marketing, debt collection, private investigators, and law enforcement. They collect massive personal consumer (and business) data, including retail purchases and returns, and salaries, and associate it in a Facebook-style graph, loosely associated with SSN and DL#.
      - bogomipz 9y ago
        Interesting about both, thanks. I suppose it's just a matter of time before both of these are compromised. In fact is surprising that they haven't. I wonder if this is just because they aren't as well known as the big 3?
kabdib 9y ago
I don't disagree, either, but whatever data Equifax has collected would be part of the bankruptcy sale. Equifax needs to wipe its data and all extant backups. Then it can be sold (for maybe ten dollars).
g051051 9y ago
Were the companies you worked for dealing with data at the scale of Equifax? Were they under the kind of unceasing attack that the Equifax systems are? Do you think you could have withstood that kind of assault on your systems? All the CRAs endure attacks at a scale that are difficult to comprehend. It's frankly a surprise that something like this hasn't happened before to any one of the big 3.
- bdamm 9y ago
  It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection. Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available if one happened to know the magic URL. This discovery was made through the process of a pen-test team sharing their findings back to development, who in turn extended their findings based on what developers knew about the system. Forensics done after the discovery revealed no cases of anyone actually finding the magic URL, which was a big relief for the company. So maybe the banks aren't as strong as we think, either. We have quite a few payment breaches to look back to as evidence.
  - g051051 9y ago
    > It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection. Can you cite a source for how we "now know how terribly fast and loose Equifax was operating"? Equifax is a CRA and is treated as a financial institution under the applicable laws, like banks are. > Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available Then you should know better than to simply claim that a company that suffers a breach is somehow inherently incompetent or uncaring about security.
    - grasshopperpurp 9y ago
      > Equifax was negligent to spill all that data, but a business model that requires all that data in one place is itself a form of negligence. - Matt Blaze http://thehill.com/opinion/technology/350197-equifax-breach-a-nightmare-that-should-serve-as-wake-up-call-for-feds http://thehill.com/opinion/technology/350197-equifax-breach-...
jacquesm 9y ago
> No, a rational company with accountability for its data doesn't outsource their IT security There are a lot of irrational companies in the world by that standard.
pmarreck 9y ago
> The nihilistic implication that nothing can be done is maddening. THIS. And in this case we have blatant evidence of negligence- There is absolutely zero excuse in this day and age to not keep operating systems patched up with security patches. There is no financial excuse, there is no logistical excuse, and given the sensitivity of the data, there is no ethical excuse. Take the responsibility seriously, or please just go off and die in a fire. (Or, if you're an Equifax executive, retire at the height of your incompetence.) Which is why I shamelessly say: Fuck Richard Smith, fuck Equifax, fuck Susan Mauldin, and fuck their entire IT management staff. What the fuck is wrong with you people? Disclaimer: I was recently hacked/had my identity stolen, and although I was fortunate to only have to wait 2 weeks to get back access to everything, I may be a little sore about stuff like this.

criddell 9y ago

In a previous discussion on HN, a pretty convincing argument was made that all the government needs to do is legislate any loss of information that includes a SSN is an automatic $100 penalty per SSN. Companies will need to buy insurance to cover this and the insurers will take care of the rest.

blowski 9y ago
Who pays the $100? The parent company or the subsidiary that can go bankrupt, and transfer its assets to another subsidiary for $1?
- seanmcdirmid 9y ago
  The insurer.
  - deleted 9y ago
    [deleted]
- criddell 9y ago
  That's not how bankruptcy works. Assets are used to pay debts including legal debts.
- pyre 9y ago
  Hiding behind bankruptcy only works if the subsidiary has no assets. Patent trolls work this to their advantage by creating a company whose only asset is the patent. If they lose / the patent is invalidated the company's only asset is worthless. They therefore have no assets to pay their debts.
- dkersten 9y ago
  Hold the directors and/or executive team personally responsible if the company folds without paying?
- dsfyu404ed 9y ago
  Whichever party the consumer gave the info too. If X gets fined then it's their job to sue someone else if they think that someone else is responsible.

mannykannot 9y ago

The idea that the only possible solution is to start over is unrealistic, unhelpful and also wrong, and is so despite your attempt to caricature anyone thinking otherwise. With proper policies, technical measures can be taken to greatly improve security over the clusterfuck that is Equifax (and probably the other agencies as well.) With proper regulation, the company (and so, indirectly, its shareholders) and its officers could be held responsible, whether or not they choose to outsource the implementation. For a start, every regulation that Equifax was lobbying to be weakened could be strengthened. In the 18th and 19th century, Britain transported many petty criminals to penal colonies in Australia. Putting aside the brutality of that policy, there was at least some concern over the number of deaths on the voyage. After other attempts failed, one simple policy brought about considerable improvement: shipowners were paid by the number of live transportees arriving. They complained mightily that it would not work, but it did. Frankly, your post looks like a self-serving defense of business-as-usual mediocrity in IT.

planar_vector 9y ago

I'd add that the vitriol against Equifax partly arises from everyone's distaste of CRA's (credit reporting agencies) owing to their magic 8 ball scheme of ranking credit. There may also be some reserved anti-sub-prime sentiment that lingers from 2008. At the very least, I hope this will cause lenders and credit reporters to take data security very seriously.

interstitial 9y ago

> If we start screaming "something must be done!", we'll be very unhappy with what actually gets done. I seldom find such wisdom in the hive. But the hive wants something to be done. Legislatures and lobbyist have this twist-o-flex down to a documented science. They love it! What ever the public wants for 30-days, can turn around into an industry wishlist in 6 months when something actually gets on the floor.

alien_at_work 9y ago

>Bob the engineering manager who committed a quick but insecure fix years ago Unacceptable. Software development needs to be treated as engineering. We need to finally rid ourselves of the concept of "quick and dirty". If that means all the people who live off of that style of development leave the industry, fantastic! It would be great if every manager who told his devs "I don't need it to be perfect, it just needs to kind of function and be ready by EOB today" could end up financially liable. >Shirley the intern who didn't know what she was doing What was she doing working on a production system unsupervised? A plumber-in-training may get to work with the pipes on his own a bit but you can be sure the certified plumber will inspect everything before signing off. The IT industry needs a shakeup and if it takes something like this to accomplish it, good.

pcsanwald 9y ago
I think it's rarely that straightforward. Think about how all the different ways software evolves: one way is, code is written when the company is first getting going, and before you have users or revenue or any kind of product/market fit, it really makes very little sense to be writing bulletproof code. "Quick and dirty" is a rational decision at the early stages of a company. A small subset of these kinds of systems end up at big companies, because they're acquired, or because the company grows, etc etc. How do you draw a line in the sand where everyone stops the world and re-implements all the "quick and dirty" stuff? I briefly worked in construction and I've seen plenty of "quick and dirty" there, also, particularly in suburban renovations. Time is money in these projects, and corners are often cut. I'm not saying all engineering works this way, clearly building bridges is a different matter, but I am pointing out that there is a spectrum.
- csydas 9y ago
  > A small subset of these kinds of systems end up at big companies, because they're acquired, or because the company grows, etc etc. How do you draw a line in the sand where everyone stops the world and re-implements all the "quick and dirty" stuff? Quite frankly, it seems like you nailed the point when someone should be re-implementing the quick and dirty stuff; the moment it gets acquired and integrated. I do understand what you're saying, but I cannot agreed that just because something is difficult to do means that one can hand-wave responsibility. In the case of large companies that have been subject to breaches recently, the only reason they get by after the fact is because they can afford to; if it were to happen to any of the small shops running in "Quick and Dirty" mode and something happened, the shop would more or less take a hit it could not recover from. I see this in action and hear the same excuse every single day with my clients, and it doesn't matter if they're a multi-national whose infrastructure spans continents or some dude with a pirated hyper v host in his room, the excuse is always the same: "Oh we had to do it that way, and didn't have time to fix it." Quite frankly, it's non-sense, infinitely moreso in virtual environments. The workflow and technology available for patch-testing, deployment, and rollback has never been faster, safer, or easier than it currently is; companies just aren't doing it, and no one is holding people accountable for negligence. If the aforementioned construction workers who did a quick and dirty job cause major damage to the house as a result, they would be liable for damages due to their negligence. I'm not sure why we in the Tech community somehow think we're above responsibility for our negligence. I understand that money is on the line - I deal with clients where every minute of down-time has a substantial dollar figure attached, and there's always the attitude of "we'll deal with it later"; and yet, this attitude always ends up causing more trouble in the end, and naturally costing far more. Edit: Changed "...responsibility for our own negligence" to remove "own"

zer00eyz 9y ago

Your describing an unfortunate series of events. Were talking about a company who had "admin" as a user name and password on a database with consumer data on it. > The better solution is to work this one out as a society. Stop relying on things like SSNs and maiden name as "security", and stop building enormous silos of unnecessary data. This doesn't stop aggregators from forming, the data has value someone will collect and sell it.

JumpCrisscross 9y ago
The only place this issue ends up, if pushed hard enough in the Congress, is mandatory licensing (with fees, of course) for software engineers. Best case: you limit such licensing requirements to certain domains.

mfringel 9y ago

"There's plenty of blame to go around" and its equivalents are semantically null.

eberkund 9y ago

This is only an issue because everyone has the "not my problem, it will never come back to me" attitude. Ideally by the time this case is fully fleshed out the blame will trickle down from the top and many people will be implicated. Either their reputation in the industry being tarnished or contracting companies getting sued by Equifax for making them liable.