9 ms·

> “Every day our team takes great strides to enhance our site’s security and we certainly anticipate that this recent data breach is the last,” McBroom said. H

> “Every day our team takes great strides to enhance our site’s security and we certainly anticipate that this recent data breach is the last,” McBroom said. Holy shit. They left an Amazon S3 bucket wide open, their admin site was wide open, and their API stream of contacts was wide open. Their concept of secuity is non-existant and they think this will be the last breach? I doubt you'd hear any competent IT director ever say they won't experience data breaches in the future. The incompetency is mind boggling.

retSava 8y ago
The embodiment of an oxymoron :) The concept of "incompetent and unaware of it" comes to mind. Edit: the Dunning-Kruger effect, https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
- zentiggr 8y ago
  Unknown unknowns?
- vanderZwan 8y ago
  > The concept of "incompetent and unaware of it" comes to mind. Well, I see that you also invoked Hanlon's Razor. I don't know if I want to give these guys that benefit of doubt - I think they genuinely don't care. Mainly because if they did they had those kinds of standards to begin with, I would expect them to also have the kinds of standards that would make it unlikely to be in this line of business. [0] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
jakeywankenobi 8y ago
Yeah. I mean, at what point does this level of neglect become criminal?
- MichaelApproved 8y ago
  In the US? No time soon. The party in power is cutting regulations, not adding them. The customer has to watch their own back. It seems simple. The free market will kill incompetent companies, right? Customers see data breaches and stop doing business with them. Sounds good in theory but realistically, customers don't have time to do the research required for a completely free market to self regulate.
  - emodendroket 8y ago
    It's not clear how I, an individual consumer, even choose to avoid doing business with Equifax.
    - bluGill 8y ago
      You could make sure you put on all loan applications that they will not check Equifax. Probably they won't even know how to handle that though and will either reject you, or ignore it.
    - dv_dt 8y ago
      Don't do business with them is a bogus missive, but you could lock your credit with all the agencies and only unlock the agencies you care to do business with when requested. But that often makes things difficult and not all users of that data will have an account with an alternative provider. (nor is the locked access the only product for which your data is offered...)
  - FilterSweep 8y ago
    It has less to do with research, even. Equifax, like many Fortune-N companies, has a heavily funded sales and PR team working actively against your individual research. Should you, as an individual, apply to a company or attempt to buy a product that has been “sold” the Equifax product suite, you’re still beholden to Equifax services(or leave without the job or house). You’re effectively stuck, unless you have the resources(time/money) to look for employers or products that stay away from Equifax.
benatkin 8y ago
AWS might be partly to blame, for not warning them, actively or passively, in my opinion. It might just be infrastructure as a service, but it seems that major cloud providers like AWS act as an IaaS provider when convenient, and a PaaS when convenient. They censor content all the time. I don't think it would be too much to ask to send an email when a big security change is made (the emails and audit log GitHub provides for its users are great). Plus their interfaces (UI and command line) are clunky. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. I'm not talking legal blame for the past mistake, just that at some point in the near future their IAM interface should be fixed. For one thing it should be easy to give permissions to view the permissions without giving keys to the kingdom. For another thing, there's a mental overhead to working with multiple AWS accounts [1]. I get the impression that Google Cloud Platform is ahead right now (while lots of other Google properties are not, heh). Edit: the spyware company is absolutely to blame, but the complexity of AWS permissions including permission to view the permissions seems like a footgun to me. However, leaving open the admin site is something I wouldn't expect AWS to help with. https://engineering.coinbase.com/you-need-more-than-one-aws-account-aws-bastions-and-assume-role-23946c6dfde3 https://engineering.coinbase.com/you-need-more-than-one-aws-...
- ryanmarsh 8y ago
  AWS defines a pretty clear delineation of responsibilities. They are responsible for security of the cloud, you are responsible for security in the cloud. https://aws.amazon.com/compliance/shared-responsibility-model/ https://aws.amazon.com/compliance/shared-responsibility-mode... I’ve not seen AWS censor content, although I’m sure some cases might warrant it. That has nothing to do with a company that was negligent. I don’t find AWS’ UI or command line clunky at all. In fact I find them clearer than most Unix tools. It is not hard to know if you have world readable buckets in S3. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. The AWS CLI allows you to easily pull the policy data attached to any resource and you can process it however you choose.
  - mehrdadn 8y ago
ryandrake 8y ago
Its hollow, phony Corp-Speak. Just like the “We at Company X take Y very seriously.” PR statement that always gets made right after Company X is caught not taking Y seriously.

retSava 8y ago

The embodiment of an oxymoron :) The concept of "incompetent and unaware of it" comes to mind. Edit: the Dunning-Kruger effect, https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

zentiggr 8y ago
Unknown unknowns?
vanderZwan 8y ago
> The concept of "incompetent and unaware of it" comes to mind. Well, I see that you also invoked Hanlon's Razor. I don't know if I want to give these guys that benefit of doubt - I think they genuinely don't care. Mainly because if they did they had those kinds of standards to begin with, I would expect them to also have the kinds of standards that would make it unlikely to be in this line of business. [0] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor

jakeywankenobi 8y ago

Yeah. I mean, at what point does this level of neglect become criminal?

MichaelApproved 8y ago
In the US? No time soon. The party in power is cutting regulations, not adding them. The customer has to watch their own back. It seems simple. The free market will kill incompetent companies, right? Customers see data breaches and stop doing business with them. Sounds good in theory but realistically, customers don't have time to do the research required for a completely free market to self regulate.
- emodendroket 8y ago
  It's not clear how I, an individual consumer, even choose to avoid doing business with Equifax.
  - bluGill 8y ago
    You could make sure you put on all loan applications that they will not check Equifax. Probably they won't even know how to handle that though and will either reject you, or ignore it.
  - dv_dt 8y ago
    Don't do business with them is a bogus missive, but you could lock your credit with all the agencies and only unlock the agencies you care to do business with when requested. But that often makes things difficult and not all users of that data will have an account with an alternative provider. (nor is the locked access the only product for which your data is offered...)
- FilterSweep 8y ago
  It has less to do with research, even. Equifax, like many Fortune-N companies, has a heavily funded sales and PR team working actively against your individual research. Should you, as an individual, apply to a company or attempt to buy a product that has been “sold” the Equifax product suite, you’re still beholden to Equifax services(or leave without the job or house). You’re effectively stuck, unless you have the resources(time/money) to look for employers or products that stay away from Equifax.

benatkin 8y ago

AWS might be partly to blame, for not warning them, actively or passively, in my opinion. It might just be infrastructure as a service, but it seems that major cloud providers like AWS act as an IaaS provider when convenient, and a PaaS when convenient. They censor content all the time. I don't think it would be too much to ask to send an email when a big security change is made (the emails and audit log GitHub provides for its users are great). Plus their interfaces (UI and command line) are clunky. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. I'm not talking legal blame for the past mistake, just that at some point in the near future their IAM interface should be fixed. For one thing it should be easy to give permissions to view the permissions without giving keys to the kingdom. For another thing, there's a mental overhead to working with multiple AWS accounts [1]. I get the impression that Google Cloud Platform is ahead right now (while lots of other Google properties are not, heh). Edit: the spyware company is absolutely to blame, but the complexity of AWS permissions including permission to view the permissions seems like a footgun to me. However, leaving open the admin site is something I wouldn't expect AWS to help with. https://engineering.coinbase.com/you-need-more-than-one-aws-account-aws-bastions-and-assume-role-23946c6dfde3 https://engineering.coinbase.com/you-need-more-than-one-aws-...

ryanmarsh 8y ago
AWS defines a pretty clear delineation of responsibilities. They are responsible for security of the cloud, you are responsible for security in the cloud. https://aws.amazon.com/compliance/shared-responsibility-model/ https://aws.amazon.com/compliance/shared-responsibility-mode... I’ve not seen AWS censor content, although I’m sure some cases might warrant it. That has nothing to do with a company that was negligent. I don’t find AWS’ UI or command line clunky at all. In fact I find them clearer than most Unix tools. It is not hard to know if you have world readable buckets in S3. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. The AWS CLI allows you to easily pull the policy data attached to any resource and you can process it however you choose.
- mehrdadn 8y ago

ryandrake 8y ago

Its hollow, phony Corp-Speak. Just like the “We at Company X take Y very seriously.” PR statement that always gets made right after Company X is caught not taking Y seriously.