4 ms·

>>> maybe Merriott shouldn't be asking for anybody's real name when they sign up for a hotel It's important to distinguish that it wasn't actually Marriott tha

>>> maybe Merriott shouldn't be asking for anybody's real name when they sign up for a hotel It's important to distinguish that it wasn't actually Marriott that had the data breach. It was starwoods resorts, now a marriott owned entity, but at the time of the breach it was not a marriott property. Marriott is being attributed to the guilty party b/c they now own starwood, but Marriott's systems were never breached, so marriott should keep doing what they are doing (presumably) and transition all the starwood systems over to the more secure marriott systems (which I believe they already said they are doing).

danShumway 8y ago
That's a really good point, Marriott just had an unlucky purchase. That being said, between the recent Google+ breaches, to the older Target breaches, it increasingly feels like I'm flipping a coin when I trust companies with data. Based on Marriott's handling of this breach, they seem to be decent at security. But I don't know how as a consumer I could tell that in advance of all of this.
- jonwachob91 8y ago
  You are 100%, and it's not just the data we provide to companies we buy products from. I got snail mail last week from an employer I haven't worked for in almost 3 years that said an administrator accidentally sent a mass email to a few thousand individuals with my bank account information, and the bank account information of everyone that was on that email chain (and I'm assuming a few other prior employees). WTF.
- arduanika 8y ago
  > Marriott just had an unlucky purchase M&A is a culprit in no small number of these cases, so let's be crystal clear: M&A does not absolve anyone of responsibility. Let me know when the underwriting bankers have their bonuses garnished for lack of due diligence, and then you can tell me about how "it wasn't actually Marriott that had the data breach". Let's say it loudly and clearly: no, it was Marriott that had the data breach.
  - danShumway 8y ago
    Eh. The breach happened before Marriott had any control or agency to stop it. Their due diligence in buying the company wouldn't have protected any consumers, it would have just meant the breach was someone else's problem. My understanding (of course, correct me if I'm wrong) is actually that their purchase is the reason the breach was disclosed -- Marriott buying the company and doing its own internal audit on their systems is why we know about it now. So I don't actually feel a ton of ill will to them, even though I agree that doesn't absolve them of the fact that they bought it, and it is now very much their problem to deal with. It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you. Having said that, this kind of underscores what I was talking about above. If Marriott themselves couldn't tell in advance that the company they were buying was an insecure liability, how the heck am I supposed to be able to tell? If it's not feasible for a company like Marriott or Verizon to know in advance of an acquisition which companies are secure and which companies aren't, consumers have no chance. There's no feasible way for a consumer to protect themselves in that world.
    - arduanika 8y ago
      > The breach happened before Marriott had any control or agency to stop it. Strongly disagree, this is playing with variables. Marriott2016 + Starwood2016 = Marriott2017. Marriott, the present day company, absolutely includes the company that had the "control or agency to stop it". > it would have just meant the breach was someone else's problem This isn't a wash. Tort is only effective if the party responsible gets punished, so it's very important which party gets punished. If Marriott had discovered the breach in due diligence, the Starwood investors' payout would have taken a big hit. As it happens, there's two behaviors that need to be disincentivized: Starwood designed faulty systems, and pawned off its ramshackle legacy crap to the highest bidder; and Marriott2016 (much like Equifax) glommed together so many legacy systems that the likelihood of breach intensified (though to Marriott's credit, the attack doesn't seem to have escalated out of the former Starwood into the parent systems. I'd still like to see steep fines imposed, but way smaller than on Equifax, proportional to that contained scope). The penalty on Marriott2017 should be steep enough to encourage future buyers to step up their due diligence enough to put the acquiree's payout at risk, while also rewarding Marriott for catching the leak before escalation. > It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you. I like your analogy a lot.
- dylan604 8y ago
  Maybe this is going to become a thing for future buy outs. Not only do the accounts have to dig into the financing and books, but the IT forensics teams will need to look for any unknown hack liabilities. If a hack is found, then the sale doesn't have to go through. Of course, the hack should have to be disclosed.
  - arduanika 8y ago
    Won't happen if the incentives aren't there.
    - dylan604 8y ago
      Wouldn't the incentive be to not have to take on the liability for it? Then again, if all a major breach results in a slap on the wrist, then I guess there's no real liability. Maybe you're right.
      - arduanika 8y ago
        Exactly. I think we're in agreement.
Darkphibre 8y ago
Oh, interesting! I was a Sr. Software consultant for Starwood back in the day. They had an interesting, grandfathered, tax scheme that allowed for insane growth. Anyway, I wrote the Sales Management and Revenue Tracking System (their name, I pushed for Revenue Tracking For Management) that helped them to prioritize and track rates across all their properties in the mid-90s. Got close to pushing them to a centralized database (instead of the per-property Access database), but left before we could finalize that project. Ugh, and the reports I had to design... they wanted smaller than 7 point font on legal paper that would then be faxed. Every property would fax quarterly reports generated by my software for board review. Interesting times.
mulmen 8y ago
Is that not just a matter of Marriott failing to do their due diligence? How does buying an incompetent company absolve you from responsibility?
- afarrell 8y ago
  It doesn't absolve you from responsibility for the harms done as a result of an action and for the financial liabilities that follow from that. But if we as engineers are evaluating the competence of an organization, it does mean that "Marriott was incompetent at security" is false.

danShumway 8y ago

That's a really good point, Marriott just had an unlucky purchase. That being said, between the recent Google+ breaches, to the older Target breaches, it increasingly feels like I'm flipping a coin when I trust companies with data. Based on Marriott's handling of this breach, they seem to be decent at security. But I don't know how as a consumer I could tell that in advance of all of this.

jonwachob91 8y ago
You are 100%, and it's not just the data we provide to companies we buy products from. I got snail mail last week from an employer I haven't worked for in almost 3 years that said an administrator accidentally sent a mass email to a few thousand individuals with my bank account information, and the bank account information of everyone that was on that email chain (and I'm assuming a few other prior employees). WTF.
arduanika 8y ago
> Marriott just had an unlucky purchase M&A is a culprit in no small number of these cases, so let's be crystal clear: M&A does not absolve anyone of responsibility. Let me know when the underwriting bankers have their bonuses garnished for lack of due diligence, and then you can tell me about how "it wasn't actually Marriott that had the data breach". Let's say it loudly and clearly: no, it was Marriott that had the data breach.
- danShumway 8y ago
  Eh. The breach happened before Marriott had any control or agency to stop it. Their due diligence in buying the company wouldn't have protected any consumers, it would have just meant the breach was someone else's problem. My understanding (of course, correct me if I'm wrong) is actually that their purchase is the reason the breach was disclosed -- Marriott buying the company and doing its own internal audit on their systems is why we know about it now. So I don't actually feel a ton of ill will to them, even though I agree that doesn't absolve them of the fact that they bought it, and it is now very much their problem to deal with. It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you. Having said that, this kind of underscores what I was talking about above. If Marriott themselves couldn't tell in advance that the company they were buying was an insecure liability, how the heck am I supposed to be able to tell? If it's not feasible for a company like Marriott or Verizon to know in advance of an acquisition which companies are secure and which companies aren't, consumers have no chance. There's no feasible way for a consumer to protect themselves in that world.
  - arduanika 8y ago
    > The breach happened before Marriott had any control or agency to stop it. Strongly disagree, this is playing with variables. Marriott2016 + Starwood2016 = Marriott2017. Marriott, the present day company, absolutely includes the company that had the "control or agency to stop it". > it would have just meant the breach was someone else's problem This isn't a wash. Tort is only effective if the party responsible gets punished, so it's very important which party gets punished. If Marriott had discovered the breach in due diligence, the Starwood investors' payout would have taken a big hit. As it happens, there's two behaviors that need to be disincentivized: Starwood designed faulty systems, and pawned off its ramshackle legacy crap to the highest bidder; and Marriott2016 (much like Equifax) glommed together so many legacy systems that the likelihood of breach intensified (though to Marriott's credit, the attack doesn't seem to have escalated out of the former Starwood into the parent systems. I'd still like to see steep fines imposed, but way smaller than on Equifax, proportional to that contained scope). The penalty on Marriott2017 should be steep enough to encourage future buyers to step up their due diligence enough to put the acquiree's payout at risk, while also rewarding Marriott for catching the leak before escalation. > It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you. I like your analogy a lot.
dylan604 8y ago
Maybe this is going to become a thing for future buy outs. Not only do the accounts have to dig into the financing and books, but the IT forensics teams will need to look for any unknown hack liabilities. If a hack is found, then the sale doesn't have to go through. Of course, the hack should have to be disclosed.
- arduanika 8y ago
  Won't happen if the incentives aren't there.
  - dylan604 8y ago
    Wouldn't the incentive be to not have to take on the liability for it? Then again, if all a major breach results in a slap on the wrist, then I guess there's no real liability. Maybe you're right.
    - arduanika 8y ago
      Exactly. I think we're in agreement.

Darkphibre 8y ago

Oh, interesting! I was a Sr. Software consultant for Starwood back in the day. They had an interesting, grandfathered, tax scheme that allowed for insane growth. Anyway, I wrote the Sales Management and Revenue Tracking System (their name, I pushed for Revenue Tracking For Management) that helped them to prioritize and track rates across all their properties in the mid-90s. Got close to pushing them to a centralized database (instead of the per-property Access database), but left before we could finalize that project. Ugh, and the reports I had to design... they wanted smaller than 7 point font on legal paper that would then be faxed. Every property would fax quarterly reports generated by my software for board review. Interesting times.

mulmen 8y ago

Is that not just a matter of Marriott failing to do their due diligence? How does buying an incompetent company absolve you from responsibility?

afarrell 8y ago
It doesn't absolve you from responsibility for the harms done as a result of an action and for the financial liabilities that follow from that. But if we as engineers are evaluating the competence of an organization, it does mean that "Marriott was incompetent at security" is false.