3 ms·

Serious question... how does any smaller, less tech-focused company have a chance of keeping data secure if not even Facebook can do it?

foolfoolz 8y ago
they don’t. your startup against 5,000 chinese. who’s gonna win
- TheCapn 8y ago
  Well let's not jump to conclusions so quickly. Reading Facebook's report it states that their vulnerability was within a feature they developed. A smaller company is likely to have less complexity in their software. Less complexity == less chance of vulnerability typically. You can't be perfect. And you likely have less talented engineers than Facebook can afford, but if your software doesn't provide these sort of bridges that Facebook developed then that's one less point of exposure you're testing/fixing/securing.
  - foolfoolz 8y ago
    the u. s. government has hacked CA providers so even companies following best practices are vulnerable. how can any company possibly compete against nation state attack?
ilovecaching 8y ago
You just do the best you can. Totally secure is a myth. As a smaller company, however, you have an advantage that your footprint is much smaller and easier to reason about. The larger you become, the more software you have to run, the more you have to manage, the more lucrative an attack on your systems will be for the attackers. That's why in security we don't play the blame game when someone gets hacked. We know it could happen to any of us, might already have happened, and we're all doing the best we can with the resources we have.
- ams6110 8y ago
  > The larger you become, the more software you have to run, the more you have to manage, the more lucrative an attack on your systems will be for the attackers. Also the more people you have who might be compromised. It's almost a certainty that there are people with access inside Facebook who are or have been corrupted. That can happen in a small company too, but the risk/reward is usually lower and there are many fewer people who can be targeted. One person with a thumb drive can exfiltrate a highly damaging amount of data.
  - mynameisvlad 8y ago
    It's not even just corruption, there's plenty of phishing attempts targeted at employees and it only takes one to potentially gain access to a lot of data depending on how systems are set up.
wepple 8y ago
To answer a different question of “why don’t we see more hacks of smaller orgs?” - Facebook is an incredibly juicy valuable target, worth investing time in - FB has a very complex application and massive codebase. Your Django web store is far more straightforward - smaller orgs can get away with not reporting, and don’t get visibility when they are compromised
vec 8y ago
One underrated option is not to keep extensive personalized records on your entire user base in the first place.
olliej 8y ago
Don’t store personal data for any longer than absolutely necessary (laws/fraud often require some records) If you must, then encrypt it so that you can never access it (eg you never have a users private keys) If you must be able to decrypt data (eg fraud/law what have you), encrypt the data to a key where the private key is separated from the rest of your system. Finally: have billions of dollars and still lose it :-/

foolfoolz 8y ago

they don’t. your startup against 5,000 chinese. who’s gonna win

TheCapn 8y ago
Well let's not jump to conclusions so quickly. Reading Facebook's report it states that their vulnerability was within a feature they developed. A smaller company is likely to have less complexity in their software. Less complexity == less chance of vulnerability typically. You can't be perfect. And you likely have less talented engineers than Facebook can afford, but if your software doesn't provide these sort of bridges that Facebook developed then that's one less point of exposure you're testing/fixing/securing.
- foolfoolz 8y ago
  the u. s. government has hacked CA providers so even companies following best practices are vulnerable. how can any company possibly compete against nation state attack?

ilovecaching 8y ago

You just do the best you can. Totally secure is a myth. As a smaller company, however, you have an advantage that your footprint is much smaller and easier to reason about. The larger you become, the more software you have to run, the more you have to manage, the more lucrative an attack on your systems will be for the attackers. That's why in security we don't play the blame game when someone gets hacked. We know it could happen to any of us, might already have happened, and we're all doing the best we can with the resources we have.

ams6110 8y ago
> The larger you become, the more software you have to run, the more you have to manage, the more lucrative an attack on your systems will be for the attackers. Also the more people you have who might be compromised. It's almost a certainty that there are people with access inside Facebook who are or have been corrupted. That can happen in a small company too, but the risk/reward is usually lower and there are many fewer people who can be targeted. One person with a thumb drive can exfiltrate a highly damaging amount of data.
- mynameisvlad 8y ago
  It's not even just corruption, there's plenty of phishing attempts targeted at employees and it only takes one to potentially gain access to a lot of data depending on how systems are set up.

wepple 8y ago

To answer a different question of “why don’t we see more hacks of smaller orgs?” - Facebook is an incredibly juicy valuable target, worth investing time in - FB has a very complex application and massive codebase. Your Django web store is far more straightforward - smaller orgs can get away with not reporting, and don’t get visibility when they are compromised

vec 8y ago

One underrated option is not to keep extensive personalized records on your entire user base in the first place.

olliej 8y ago

Don’t store personal data for any longer than absolutely necessary (laws/fraud often require some records) If you must, then encrypt it so that you can never access it (eg you never have a users private keys) If you must be able to decrypt data (eg fraud/law what have you), encrypt the data to a key where the private key is separated from the rest of your system. Finally: have billions of dollars and still lose it :-/