3 ms·
It wouldn't have mattered, but they should absolutely still be doing it to mitigate exposure through loss of physical disks, and this question should be an easy
by lawnchair_larry 9y ago
It wouldn't have mattered, but they should absolutely still be doing it to mitigate exposure through loss of physical disks, and this question should be an easy yes.
The other reason to do it, frankly, is because when you end up in the news, this is the first thing everyone asks. It's easier to say yes than to "no, but..." and explain why this is a dumb question to ask (as you are trying to do here, with a far more technical audience).
- tptacek 9y agoI mostly agree, but my concern is that this is not the perspective most people, including practitioners, are bringing to the discussion when they talk about "encryption". They mean, "if you had encrypted, this data never would have been exfiltrated in a breach". Which, of course, is false.
- mannykannot 9y agoFair enough, but I think we should be careful not to encourage the replacement of this perspective with one that says Equifax (and other collectors of sensitive data) could not be expected to do / have done better. I was quite surprised (though I probably should not have been) by the number of IT people advocating that position.