4 ms·

It's worth stressing that Deloitte is not a cyber security firm primarily. It's actually much worse (for them): they're a Big 4 audit company [1]. The fact tha

by DCKing 9y ago

It's worth stressing that Deloitte is not a cyber security firm primarily. It's actually much worse (for them): they're a Big 4 audit company [1]. The fact that they are such a company both explains the situation and makes it worse. First, one should realize that 99.8% of people working at these companies don't know the first thing about cyber security. The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affairs. Second, attackers getting access to security-related material might be bad, but it will be much worse for Deloitte if people get access to the financially sensitive data that the majority of their employees work on. Not only can this be more directly damaging to their clients, this data and the responsibilities around it are affected by many more laws and regulations. [1]: https://en.wikipedia.org/wiki/Big_Four_accounting_firms https://en.wikipedia.org/wiki/Big_Four_accounting_firms [2]: This typically also depends on which local franchisee of the Big Four brand you're talking to, but let's not go down that rabbit hole.

provost 9y ago
In addition to what you've described, there are likely "Privileged & Confidential" conversations between lawyers and those within the org seeking counsel. Those emails are likely the most sensitive in nature.
aplummer 9y ago
> The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affairs. I think your percentages are off (over ~60% of the firm's revenue is now consulting, a large part digital), but this hits the nail on the head. On the external consulting side, I was regularly in fruitless heated argument with internal IT. As bad as it is, I think the recovery spin to clients (it's an important point and true) is the the engineers they are getting in a consulting capacity are completely separate to the people managing the laptops. I do think your second footnote is important too, these are totally separate companies. This is a Deloitte US breach, the IT systems are totally separate. The brand damage (the value of the information in the audit records if unreleased is astronomical) will be shared, but at least the scope of the actual leak will be limited to that member firm.

by DCKing 9y ago

provost 9y ago

In addition to what you've described, there are likely "Privileged & Confidential" conversations between lawyers and those within the org seeking counsel. Those emails are likely the most sensitive in nature.

aplummer 9y ago

> The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affairs. I think your percentages are off (over ~60% of the firm's revenue is now consulting, a large part digital), but this hits the nail on the head. On the external consulting side, I was regularly in fruitless heated argument with internal IT. As bad as it is, I think the recovery spin to clients (it's an important point and true) is the the engineers they are getting in a consulting capacity are completely separate to the people managing the laptops. I do think your second footnote is important too, these are totally separate companies. This is a Deloitte US breach, the IT systems are totally separate. The brand damage (the value of the information in the audit records if unreleased is astronomical) will be shared, but at least the scope of the actual leak will be limited to that member firm.