5 ms·

Marriott’s breach response is so bad, security experts are filling in the gaps

106 points by guiambros 8y ago

Cyphase 8y ago
Things like this seem to indicate an almost complete lack of competence in regards to security and breach response. Can Marriott not afford to hire one full-time, experienced, competent person to oversee security policy? Of course they can. But it seems that they haven't, because someone who's job it is to oversee security policy should certainly be right in the middle of Marriot's response process, and should have caught something like this. I'm not saying there are no competent people doing security at Marriott. If you work at Marriott doing security work, I'm not trying to attack you; this kind of thing is not one person's fault (unless it really, really, really is, and not even then, because the other people in the organization shouldn't have allowed such a single-point-of-failure). But really.. it's just abysmal.
- JustSomeNobody 8y ago
  The top two items in the MBA handbook is firstly to keep personnel count as low as possible (because the few left are more "productive" somehow) and secondly to shrink any IT department to the bare minimum (it's a cost center, no good comes from a cost center).
diminoten 8y ago
I signed up for the monitoring service they provided, and much to my delight I discovered the service retails for $130 annually. I genuinely hope Marriott has to pay that price, even though I've given it no information to monitor except my email address. I suggest as many people as possible sign up for this service.
- collective 8y ago
  this type of service is typically part of cyber insurance, which is dirt cheap today. perhaps their premiums will rise.
- joshstrange 8y ago
  So it probably is a paid worse version of Have I Been Pwned...
TeMPOraL 8y ago
Could someone explain to me what's up with the "monitoring services"? I recently read a book on infosec risk, and they keep mentioning that the usual response for data breach involves sponsoring a "credit monitoring service" for customers. Marriott is now referring people to some non-credit "monitoring service", that (from skimming their site) ultimately tries to fill in some holes left by "credit monitoring". Here's what I don't understand: - Why? - Why is that not a service provided by a bank, as a part of having a credit card? - Why do individuals have to pay some random third parties to protect themselves from some fraudster defrauding some bank via data obtained from some company (even if, in publicized breach cases, this gets covered by breached company)? - (Somewhat related) how is it that your "credit score" isn't just a number on your bank dashboard, but you have to pay third parties to discover it? It can't be that all of this is just a legalized racket, can it? Because if feels like it is.
- koolba 8y ago
  > - Why? Because they’re probably paying Marriot for the privilege of being listed as a provider for monitoring services. Once the free tier runs out they’ll try to milk the consumers for an ongoing protection charge. > - Why is that not a service provided by a bank, as a part of having a credit card? Separation of concerns. A bank or card issuer cares more about covering their own liability for fraud on a particular card. They don’t care if a new one gets issued in your name somewhere else or if a line of credit gets opened. > - Why do individuals have to pay some random third parties to protect themselves from some fraudster defrauding some bank via data obtained from some company (even if, in publicized breach cases, this gets covered by breached company)? That’s not strictly true. Freezing your credit across all the major credit agencies is free. They likely don’t want you to know or do that as it also limits junk mail for credit cards. > - (Somewhat related) how is it that your "credit score" isn't just a number on your bank dashboard, but you have to pay third parties to discover it? It can't be that all of this is just a legalized racket, can it? Because if feels like it is. It is a racket with a private sector origin that effectively got standardized over the years. There’s a number of private organizations that provide “credit scores” with FICO being the most prominent. Starting a few years ago most financial providers provide free access to your current score or some “fako” equivalent.
gammateam 8y ago
Unions should post bug bounties on their employers for a more modern take on relevance and contract negotiations Because that two month strike was an exercise in futility Would harden the employer system too
ericd 8y ago
Anyone know if there are any grounds for a class action?
Angostura 8y ago
To me the annoying thing about the e-mail from Marriott that I received, was that it simply says my details 'may' have been breached and that 'some' of the breached e-mails had various types of data stolen. I understand this as an initial response. What I don't appreciate is the lack of a line in the e-mail saying 'as soon as we have more details about the extent of the breach for your particular account. we will let you know. I still have no real idea what was stolen and I don't know if I'll ever be told.
kop316 8y ago
Personally, I would like to see a legislation similar to the Privacy Act of 1974 be passed that governs how cooperation's use PII: https://en.wikipedia.org/wiki/Privacy_Act_of_1974 https://en.wikipedia.org/wiki/Privacy_Act_of_1974
davidhyde 8y ago
Perhaps marriott.com would be at risk of being sent to junkmail if they sent out mass security update emails. Maybe that’s a risk they weren’t willing to take. They clearly only care about their business and not their customers so why would they junk their domain?
eeeeeeeeeeeee 8y ago
The letter I received from Marriott went straight to my spam folder (Gmail).

106 points by guiambros 8y ago

Things like this seem to indicate an almost complete lack of competence in regards to security and breach response. Can Marriott not afford to hire one full-time, experienced, competent person to oversee security policy? Of course they can. But it seems that they haven't, because someone who's job it is to oversee security policy should certainly be right in the middle of Marriot's response process, and should have caught something like this. I'm not saying there are no competent people doing security at Marriott. If you work at Marriott doing security work, I'm not trying to attack you; this kind of thing is not one person's fault (unless it really, really, really is, and not even then, because the other people in the organization shouldn't have allowed such a single-point-of-failure). But really.. it's just abysmal.

JustSomeNobody 8y ago
The top two items in the MBA handbook is firstly to keep personnel count as low as possible (because the few left are more "productive" somehow) and secondly to shrink any IT department to the bare minimum (it's a cost center, no good comes from a cost center).

diminoten 8y ago

I signed up for the monitoring service they provided, and much to my delight I discovered the service retails for $130 annually. I genuinely hope Marriott has to pay that price, even though I've given it no information to monitor except my email address. I suggest as many people as possible sign up for this service.

collective 8y ago
this type of service is typically part of cyber insurance, which is dirt cheap today. perhaps their premiums will rise.
joshstrange 8y ago
So it probably is a paid worse version of Have I Been Pwned...

TeMPOraL 8y ago

Could someone explain to me what's up with the "monitoring services"? I recently read a book on infosec risk, and they keep mentioning that the usual response for data breach involves sponsoring a "credit monitoring service" for customers. Marriott is now referring people to some non-credit "monitoring service", that (from skimming their site) ultimately tries to fill in some holes left by "credit monitoring". Here's what I don't understand: - Why? - Why is that not a service provided by a bank, as a part of having a credit card? - Why do individuals have to pay some random third parties to protect themselves from some fraudster defrauding some bank via data obtained from some company (even if, in publicized breach cases, this gets covered by breached company)? - (Somewhat related) how is it that your "credit score" isn't just a number on your bank dashboard, but you have to pay third parties to discover it? It can't be that all of this is just a legalized racket, can it? Because if feels like it is.

koolba 8y ago
> - Why? Because they’re probably paying Marriot for the privilege of being listed as a provider for monitoring services. Once the free tier runs out they’ll try to milk the consumers for an ongoing protection charge. > - Why is that not a service provided by a bank, as a part of having a credit card? Separation of concerns. A bank or card issuer cares more about covering their own liability for fraud on a particular card. They don’t care if a new one gets issued in your name somewhere else or if a line of credit gets opened. > - Why do individuals have to pay some random third parties to protect themselves from some fraudster defrauding some bank via data obtained from some company (even if, in publicized breach cases, this gets covered by breached company)? That’s not strictly true. Freezing your credit across all the major credit agencies is free. They likely don’t want you to know or do that as it also limits junk mail for credit cards. > - (Somewhat related) how is it that your "credit score" isn't just a number on your bank dashboard, but you have to pay third parties to discover it? It can't be that all of this is just a legalized racket, can it? Because if feels like it is. It is a racket with a private sector origin that effectively got standardized over the years. There’s a number of private organizations that provide “credit scores” with FICO being the most prominent. Starting a few years ago most financial providers provide free access to your current score or some “fako” equivalent.

gammateam 8y ago

Unions should post bug bounties on their employers for a more modern take on relevance and contract negotiations Because that two month strike was an exercise in futility Would harden the employer system too

ericd 8y ago

Anyone know if there are any grounds for a class action?

Angostura 8y ago

To me the annoying thing about the e-mail from Marriott that I received, was that it simply says my details 'may' have been breached and that 'some' of the breached e-mails had various types of data stolen. I understand this as an initial response. What I don't appreciate is the lack of a line in the e-mail saying 'as soon as we have more details about the extent of the breach for your particular account. we will let you know. I still have no real idea what was stolen and I don't know if I'll ever be told.

kop316 8y ago

Personally, I would like to see a legislation similar to the Privacy Act of 1974 be passed that governs how cooperation's use PII: https://en.wikipedia.org/wiki/Privacy_Act_of_1974 https://en.wikipedia.org/wiki/Privacy_Act_of_1974

davidhyde 8y ago

Perhaps marriott.com would be at risk of being sent to junkmail if they sent out mass security update emails. Maybe that’s a risk they weren’t willing to take. They clearly only care about their business and not their customers so why would they junk their domain?

eeeeeeeeeeeee 8y ago

The letter I received from Marriott went straight to my spam folder (Gmail).