4 ms·
Forget complicated questions about corporate policy, the costs of verifying security, the limited negative impact that companies seemingly face when problems li
by harryh 9y ago
Forget complicated questions about corporate policy, the costs of verifying security, the limited negative impact that companies seemingly face when problems like this happen. Those questions are definitely interesting, but they're hard questions and I'm not in the mood for hard thinking right this second.
What blows my mind here is the actions of a single person. The Security Director got an email about a dead simple vulnerability in his company's website/api. All he had to do was paste a single link into a browser to verify that there was a big big problem. And he did nothing?
I simply can't understand that.
What was this guy doing every day? Did he have any sense of professional self respect at all? Did he think it would just....go away? It's so confusing.
Do you think he....didn't know how to decrypt the PGP encrypted description? And that he was too embarrassed to say so? In a weird way that's my most charitable explanation.
- whoisjuan 9y agoYeah. He probably googled "How to generate a PGP key", then he generated it, sent it and then he was not able to decrypt it or didn't do it, possibly out of laziness... But also given the current state of the website they probably don't even know how those APIs work either.
- chrissnell 9y agoI wouldn't be surprised if he googled how to generate the key, generated the key, sent the key, and then forgot the passphrase.
- irrational 9y agoDid you notice the part about his previous job as the director of security for Equifax? He is obviously clueless about technology and security.
- harryh 9y agoWhile I am sure that there are clueless people that have worked on the security team at Equifax, I'm willing to bet that there have been good people too. It's hard to sort out the good from the bad and what problems are individual and what were systemic.
- exabrial 9y agoPutting a person, who majored in music theory, into the Information Security Officer position at a company of Equifax's size, shows how much they actually regard your information as something important. I actually dislike bringing this up, because I respect the people the have gone through music education; while it doesn't pay in terms of salary, it's certainly something they are passionate about and love dearly. But just as they would not hire me to direct an orchestra, I would not hire them to secure critical Financial systems. This isn't to say there is a fault with them, it's just to say that we all have our strengths in certain areas.
- wglb 9y agoThis is clearly wrong. Do you know who Mudge is? Check out the wikipedia page for him at https://en.wikipedia.org/wiki/Peiter_Zatko https://en.wikipedia.org/wiki/Peiter_Zatko and note his degree.
- irrational 9y agoAren't we talking about Mike Gustavison? Does Peiter Zatko work at Equifax or Panera?
- wglb 9y agoWe are apparently talking about who majored in music theory and my point is that is totally irrelevant.
- djsumdog 9y agoI'm glad I kept reading to the end of the article. That part made me laugh hysterically.
- chx 9y ago> Do you think he....didn't know how to decrypt the PGP encrypted description? And that he was too embarrassed to say so? The first part is OK, he is a director, not a grunt. The second is harder to understand. He should've handed the entire thing over, starting with the PGP thing to an actual security knowing engineer.
- harryh 9y agoOr he could google it. I don't know how to PGP decrypt something off the top of my head, but I'm confident that 5 minutes of googling would lead me to any number of web pages to show me how.
- chx 9y agoThat's not an efficient use of his time. The first answer instead of that adversial crap should've been "Let me introduce you to my colleague John Doe who will be handling this matter. John, a mutual acquaintance introduced Dylan to me as a reputable security researcher, please handle his report. -Signature." He is a director, he needs to delegate ferociously. Unless it's organizing, strategizing etc it's below his concern. I have been on the receiving end of such emails a bazillion times in my carrier. My boss or the boss of my boss is certainly not going to bother with such small affairs. It is my duty to inform him when it turns out to be a big affair then he can begin to coordinate with engineering, marketing and so on to do the release. That's his job.
- wglb 9y agoBut he didn't do any of this. If you are CSO or CISO or director, you dang well better know what gpg is, and how to quickly find someone in the organization who knows how to deal with it.
- AstralStorm 9y agoThe whole problem is that there has to be a competent engineer who does not want to use this knowledge to get famous. See, a Security Director would love to see a direct report of their inadequacy buried... if someone knows then it is harder to bury.
- fricat1ve 9y agoYou are assuming this was merely a technical issue that went unnoticed, but in situations like this it is of course possible that there are other issues with process and governance that are coming into play. If you want something from a corporation, the best course of action is generally to just write (i.e. snail mail) to the CEO, because they are the only person you can be certain is capable of re-marshaling resources to deal with the root cause of the problem, whatever it may be.
- ovao 9y ago> ...it is of course possible that there are other issues with process and governance that are coming into play. Likely, but shouldn’t the director of information security be given more power to take action? I’d think that if that was my title for an outfit like Panera, and if I couldn’t enact any kind of change in face of a fairly serious vulnerability in the span of eight months, I would resign from said position. Because what’s the point of my job, if that’s what I’m dealing with?