4 ms·

It's quite scary to think that a bank only fix obvious security issues after public shaming. There are a lot of internal services in a bank that are not exposed

It's quite scary to think that a bank only fix obvious security issues after public shaming. There are a lot of internal services in a bank that are not exposed to the scrutiny of security researchers and will therefor never get patched.

zentiggr 8y ago
Right, and that applies to probably all but a small percentage of organizations. Not malice, just management that doesn't properly account for the negatives involved in poor security policy. Banks are no exception to the rule that all the managers are humans, and may not have the best information / mindset. Fix the lowest hanging fruit as fast as possible, and raise the mean incrementally.
lostapathy 8y ago
What sucks is that for every breach you hear about, odds are somebody “on the inside” has tried to raise the alarm and been ignored, or marginalized, for it. Then after the breach they often take it very hard. To the extreme, a former employer suffered a major breach (after I was gone) and from what I heard a really great dev was distraught to the point I worried he might be suicidal. All made worse because the organization as a whole didn’t learn, there were no obvious consequences for the management at fault, so he took it even more personally, when it truly wasn’t his fault a breach happened. We need a way to give these people a voice before bad things happen, not just therapy after something they saw coming goes bad.
lolc 8y ago
Yes! What does it say about internal security if a bank leaves its mailbox unlocked. (The postal equivalent of not using SSL.) For those that would prefer other methods because public shaming doesn't fix everything: Let's look at some scenarios what (successful) shaming of publicly available services could do: 1. lead to audit and discovery of the issues in the internal services 2. bolster the argument of internal people who argue for security improvements 3. reset priorities to fix issues in public instances instead of fixing internal ones
- user5994461 8y ago
  It's not comparable. A mailbox is in a physical location and you have to be next to it to use it. An email box is specifically meant to be opened anytime from anywhere on the planet. It's insecure by design.
  - lolc 8y ago
    Agreed but I wanted to compare an unlocked mailbox at a bank to not using SSL on their website.

zentiggr 8y ago

Right, and that applies to probably all but a small percentage of organizations. Not malice, just management that doesn't properly account for the negatives involved in poor security policy. Banks are no exception to the rule that all the managers are humans, and may not have the best information / mindset. Fix the lowest hanging fruit as fast as possible, and raise the mean incrementally.

lostapathy 8y ago

What sucks is that for every breach you hear about, odds are somebody “on the inside” has tried to raise the alarm and been ignored, or marginalized, for it. Then after the breach they often take it very hard. To the extreme, a former employer suffered a major breach (after I was gone) and from what I heard a really great dev was distraught to the point I worried he might be suicidal. All made worse because the organization as a whole didn’t learn, there were no obvious consequences for the management at fault, so he took it even more personally, when it truly wasn’t his fault a breach happened. We need a way to give these people a voice before bad things happen, not just therapy after something they saw coming goes bad.

lolc 8y ago

Yes! What does it say about internal security if a bank leaves its mailbox unlocked. (The postal equivalent of not using SSL.) For those that would prefer other methods because public shaming doesn't fix everything: Let's look at some scenarios what (successful) shaming of publicly available services could do: 1. lead to audit and discovery of the issues in the internal services 2. bolster the argument of internal people who argue for security improvements 3. reset priorities to fix issues in public instances instead of fixing internal ones

user5994461 8y ago
It's not comparable. A mailbox is in a physical location and you have to be next to it to use it. An email box is specifically meant to be opened anytime from anywhere on the planet. It's insecure by design.
- lolc 8y ago
  Agreed but I wanted to compare an unlocked mailbox at a bank to not using SSL on their website.