4 ms·

Without looking it up, I’ll throw my chips on the table that they offshore the majority of their IT.

mavelikara 9y ago
Offshore or outsource?
greedy_buffer 9y ago
Maybe. The separate domain might be explained by lack of trust in their PR company though. See Krebs' article: https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/ https://krebsonsecurity.com/2017/09/equifax-breach-response-...
drieddust 9y ago
That's just Horseshit. I have worked on both sides of the table and incompetence is equally widespread. However, vendors are not as bad as they seems to appear and employees are not as good as they seems to appear. Most of the contracts nowadays have a penalty clause and a stated Service Level Agreements (SLA) around performing the vulnerability scan and closing the GAP within a stipulated time frame. Outsourcing companies might not be innovative but they don't like to lose money on failing SLAs. Coming back to the issue of incompetence. I have often seen so called innovator of the just taking the credit for the work done by Vendor. The way typical scenario rolls out is this. Senior management of of the company will throw a challenge to the senior management of Vendor. After a few discussions middle management of will assign the responsibility to their lowest level employees. After a lot of hard work when solution is in sight, all communication channels will be closed. A few weeks later solution will be presented to their own management while keeping the vendor completely out of loop as if vendor was completely useless and they did all the hard work. Vendor will be presented as mindless robot who can just execute the instruction. Hell I have seen employees not even having the courtesy even the reword our solutions. Incentives of employees are aligned with making the vendor look less effective or they themselves will be replaced at some point by their own higher management. I think its not their fault. It is just the environment where painting the vendor in positive color will be detrimental to employee's own job.
- dasil003 9y ago
  I'm sorry this happened to you, it sucks to not get credit for your work. I think the explanation is simpler though. There is no incentive to say either good things or bad things about a Vendor, the incentive is to keep the focus on the internal people that were involved, because recognizing internal employees is critical for morale and general team cohesion. Recognizing a Vendor's effort could potentially backfire and lead to bad blood internally (happens with consultants all the time) and is not really a priority because the engagement is based on a negotiated contract that is primarily driven by financial or expertise reasons, not the human elements. The fact is, the Vendor is the one that should be worried about the morale of their own employees. The Vendor's management should be praising the good work of the employees, and if there is blatant disrespect coming down from the Company, it is their job to either address it or at least justify to appease their rank and file.
  - drieddust 9y ago
    I completely agree with you and I am not sour about it at all. In corporate environment everyone works for their self interest and as vendor we are happy if we are getting paid. I was just calling out the passive aggressive parent comment.
throwaway1 9y ago
Without looking it up, I’ll throw my chips on the table and claim that you would like to just blame offshoring for any problem without providing any substantive proof. If there was a vendor involved - Equifax would have already jumped on that fact and blamed the vendor. They would have already played the oh-we-had-a-bad-vendor-and-fired-them-immediately game by now.
- Chris2048 9y ago
  why would they? they hired the vendor, they'd be still to blame.
smt88 9y ago
Their executives were incredibly incompetent. Whether your people are offshore or not, a competent leader knows to tell them to do things properly and knows enough to verify the basics. None of that was done.

Offshore or outsource?

Maybe. The separate domain might be explained by lack of trust in their PR company though. See Krebs' article: https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/ https://krebsonsecurity.com/2017/09/equifax-breach-response-...

drieddust 9y ago

That's just Horseshit. I have worked on both sides of the table and incompetence is equally widespread. However, vendors are not as bad as they seems to appear and employees are not as good as they seems to appear. Most of the contracts nowadays have a penalty clause and a stated Service Level Agreements (SLA) around performing the vulnerability scan and closing the GAP within a stipulated time frame. Outsourcing companies might not be innovative but they don't like to lose money on failing SLAs. Coming back to the issue of incompetence. I have often seen so called innovator of the just taking the credit for the work done by Vendor. The way typical scenario rolls out is this. Senior management of of the company will throw a challenge to the senior management of Vendor. After a few discussions middle management of will assign the responsibility to their lowest level employees. After a lot of hard work when solution is in sight, all communication channels will be closed. A few weeks later solution will be presented to their own management while keeping the vendor completely out of loop as if vendor was completely useless and they did all the hard work. Vendor will be presented as mindless robot who can just execute the instruction. Hell I have seen employees not even having the courtesy even the reword our solutions. Incentives of employees are aligned with making the vendor look less effective or they themselves will be replaced at some point by their own higher management. I think its not their fault. It is just the environment where painting the vendor in positive color will be detrimental to employee's own job.

dasil003 9y ago
I'm sorry this happened to you, it sucks to not get credit for your work. I think the explanation is simpler though. There is no incentive to say either good things or bad things about a Vendor, the incentive is to keep the focus on the internal people that were involved, because recognizing internal employees is critical for morale and general team cohesion. Recognizing a Vendor's effort could potentially backfire and lead to bad blood internally (happens with consultants all the time) and is not really a priority because the engagement is based on a negotiated contract that is primarily driven by financial or expertise reasons, not the human elements. The fact is, the Vendor is the one that should be worried about the morale of their own employees. The Vendor's management should be praising the good work of the employees, and if there is blatant disrespect coming down from the Company, it is their job to either address it or at least justify to appease their rank and file.
- drieddust 9y ago
  I completely agree with you and I am not sour about it at all. In corporate environment everyone works for their self interest and as vendor we are happy if we are getting paid. I was just calling out the passive aggressive parent comment.

throwaway1 9y ago

Without looking it up, I’ll throw my chips on the table and claim that you would like to just blame offshoring for any problem without providing any substantive proof. If there was a vendor involved - Equifax would have already jumped on that fact and blamed the vendor. They would have already played the oh-we-had-a-bad-vendor-and-fired-them-immediately game by now.

Chris2048 9y ago
why would they? they hired the vendor, they'd be still to blame.

smt88 9y ago

Their executives were incredibly incompetent. Whether your people are offshore or not, a competent leader knows to tell them to do things properly and knows enough to verify the basics. None of that was done.