4 ms·

So I'm not a security expert, so I ask this in real earnest to learn: what is it that these companies keep doing wrong, and/or why aren't they adjusting to the

• spydum 8y ago
  Sadly, security is still hard in a lot of cases, and most everyone (product / developer / customer) is fixated on features and performance. Security is only important when it fails (very much like availability) - and by then it is really hard to retrofit.
• dyu 8y ago
  As an example, consider an army attacking a defending army. The defending side is as good as the weakest member, because you can presume the attacking side to be looking for the weakest part and attacking that. On the other hand, the attacking side is as good as the strongest member, and having a few weaker members is ok. It is generally harder to make sure you have uniformly good defense, than getting a few really good people to spend dedicated time attacking. Of course, this model assumes that as soon as you have penetrated the perimeter, the rest becomes easy. This is the more traditional model. People are increasingly adopting a you-are-already-hacked approach, which makes it harder to move laterally once someone gets in. However, the general challenge still applies.
• deleted 8y ago
  [deleted]
• mulmen 8y ago
  No harm comes to the company after a breach so from their perspective there is no risk. Since there is no risk there is no need to improve security or reduce retained data. It’s not really a security issue as much as an incentive issue.
• deleted 8y ago
  [deleted]
• toofy 8y ago
  It’s a whole lot of things, but first and foremost and probably the simplest explanation, security is hard. Incredibly hard. Once you understand how difficult attack mitigation is, then you can pick and choose from a variety of factors: - executives may not have a realistic understanding of how difficult attack mitigation is so they don’t allocate the resources for hiring - incompetent admins overestimating their abilities - competent admins who are underfunded - incompetent admins who underestimate the value of the data they’re protecting - competetent admins who may not have an accurate picture of what data they’re trying to protect so their threat model is flawed due to inaccurate information - executives who are aware of how difficult mitigation is but don’t place customer data privacy as a priority. - the current iteration of our growth obsessed corporate models unintentionally results in a race to the bottom in many ways. - little incentive for companies to factor in social impacts as we don’t yet seem inclined to figure out a way to include impacts on society as one of the many metrics to measure a company’s success or failures. It’s worth remembering though, even the most responsible, most well funded, most security conscious, and best staffed organizations have been compromised at one point or another—security is hard.
  • closeparen 8y ago
    An organization running original software on the internet first needs to be preventing vulnerabilities in its own codebase. Nothing “admins” do is going to help much if the application itself is full of SQL injection and direct object reference. You can have impeccable configuration, firewalls, etc. and not even be playing the game.
    • toofy 8y ago
      Absolutely. Apologies if I indicated my list were the only possible issues at play.
    • jiveturkey 8y ago
      WAF
  • jbottoms 8y ago
    Security is not too difficult on a decent network. There are several that meet Federal requirements. The problem is that the Web design was leaky in the first place. The companies that specified it wanted free flowing data above all else with authenication behind the firewall. But the W3c browser is not secure. Tim's comments notwithstanding, this occurred on his watch. We're due for a serious network, not another toy.
• diego 8y ago
  In this particular case it doesn't seem too bad. Someone's name and address are not (or should not be) particularly sensitive information. Passwords are, and that's why best practices only keep a one-way function of the password ("encrypted" implies that it can be decrypted to plaintext, which should not be the case). Luckily you can sign up for Quora with any name and email. You have to assume that no matter how hard a site tries to protect your info, it will get compromised sooner or later. The best they can do is what Quora does: demand as little info about you as they need.
  • larkeith 8y ago
    For anyone who missed it in Quora's post, passwords were salted and hashed, which makes it functionally impossible to decrypt en-masse. Targeted attacks (trying to discover a specific user's password) may or may not be feasible, depending on if the salts were retrieved, how many iterations and which hashing algorithm was used, and the processing power available to the attacker.
• reactor 8y ago
  In addition to what others mentioned, hackers usually got very high patience, it pays over time.
• deleted 8y ago
  [deleted]
• tedunangst 8y ago
  Effectively nobody is secure against an insider threat. Whereby I mean a sales agent who clicks offer.pdf.exe. Which allows an attacker to find your internal traffic stats billboard running last years unpatched drupal. Which has MySQL creds for your database sitting on it.
• tomjen3 8y ago
  They aren't being incentiviced hard enough. Security costs money and can be inconvenient both for you and the users, which is not good for startups. In addition to that, attackers only have to get lucky once, the defenders have to check every entryway.
• drivebycomment 8y ago
  Information security is inherently asymmetric in offense vs defense: Offense needs only one hole, whereas defense needs to plug all, including human behaviors. When the offensive side finds a new attack, they can often try and see which of the victim is vulnerable, thus the offense can pick and choose among many potential victims, whereas the defensive side needs to defend from all attackers. The information, once leaked, can't be recovered - i.e. once exploit is successful, there's no "recovery" available. All of those factors combined make defense orders of magnitude more difficult - in terms of careful attention to detail, in terms of manpower, in terms of human training and vigilance, etc. For those reasons, the best defensive strategy is to minimize the information you need to protect.
• magnamerc 8y ago
  It's not the companies, it's the internet itself. The internet is only composed of communication protocols, with security as an after-thought. The solution to this is incorporating security at the protocol layer, which is the end game of crypto platforms like Ethereum.
  • fogetti 8y ago
    I am not convinced by this narrative. I would rather assume that like any ordinary project, Quora also was developed with zero security in mind. I would bet in a huge amount that noone has ever said during any project meeting that `BTW. I think we should spend 2 more months implementing every detail securely`. Probably security was an afterthought.
    • magnamerc 8y ago
      Security is always an after-thought. That's the problem, there's no financial incentive to keep your data secure.