9 ms·
I would've thought by now the security consultant industry would be really robust and large corporations like Marriott would be advised to handle low hanging fr
by 40acres 8y ago
I would've thought by now the security consultant industry would be really robust and large corporations like Marriott would be advised to handle low hanging fruit like "encrypt everything". Anyone know the current state of the industry?
- munchbunny 8y agoI think this blog post from Brian Krebs captures the problem pretty well: https://krebsonsecurity.com/2018/12/a-chief-security-concern-for-executive-teams/ https://krebsonsecurity.com/2018/12/a-chief-security-concern... There's a lack of attention at the executive and organization levels in these major corporations, so they're not set up to deal with security threats in a forward looking way.
- ganoushoreilly 8y agoThe industry is robust, companies just refuse to spend money on security because the risks aren’t all that great to them and insurance policies are paid out regardless.
- jlgray 8y agoI'm ever so slightly optimistic in this regard. As soon as we see a few GDPR-related penalties assessed, the risk-reward calculation will change drastically. According to their 2017 annual report [1], Marriot had $22.9bn in worldwide revenue. A 4% penalty on that would be $900M. [1] https://marriott.gcs-web.com/static-files/057a8e1a-a5c5-4c20-a51c-0b20bf8a0bc1 https://marriott.gcs-web.com/static-files/057a8e1a-a5c5-4c20...
- reaperducer 8y agoI read that there was some kind of grace period involving GDPR penalties. Has the EU handed out any fines yet, or is it still letting companies adjust?
- qznc 8y agoYes, the first case is done: https://www.welivesecurity.com/2018/11/27/german-chat-site-faces-fine-gdpr/ https://www.welivesecurity.com/2018/11/27/german-chat-site-f... The question is probably if it is state of the art to encrypt passport numbers. If yes, then Marriot could be fine with a similiar argument of "the company knowingly violated its duty to ensure data security".
- kazen44 8y ago> I read that there was some kind of grace period involving GDPR penalties. the grace period started two years ago until may 2018... people seem to forget that the GDPR was technically already a law in 2016, it was just not enforced.
- gamma-male 8y agoI've seen employees demonstrating every day for months in front of the Marriott in San Francisco. Didn't think they were doing that good.
- elliekelly 8y agoThis is spot on. I was the Chief Information Security/Privacy Officer at an investment bank and had to _beg_ for a system to scan email and automatically encrypt if it detected PII.
- staplers 8y agoAnyone know the current state of the industry? Large corporations are run by business majors who often have a disdain for computer science. Usually this leads to not hiring the top security experts (either through lack of knowledge or not wanting anyone smarter than themselves at the wheel). I've personally seen this at a few jobs. It can go both ways as often CS-saavy startup founders are the same way towards business majors.
- lotsofpulp 8y agoI think it's mostly the fact that the cost of data breaches is less than the savings (i.e. profit) from not implementing rigorous systems.
- staplers 8y agoFREE and OSS CMS' encrypt customer data now.. Don't know where this myth that it costs money to do basic encryption is coming from..
- myrion 8y agoThe cost in this case would be in switching. They're already using a system that works for them, why bother changing to something else?
- Kalium 8y agoYou're absolutely right! The basic software infrastructure that can be adapted to safely and securely handle user data is completely free. It may be worth considering that adapting said FLOSS software, doing the requisite custom integration work, and then doing a large migration successfully might all be perhaps slightly less free than the software you correctly and wisely point to.
- sbarre 8y agoLarge enterprises have extremely complex and interconnected systems. The real costs and work is in the migration and adoption of new tools (regardless of the cost of the tools themselves).
- manishsharan 8y agoIts likely that all major enterprises are waiting for Oracle to come up with data -at-rest-encryption and then they will likely follow along.
- iancnorden 8y agoTDE has existed for a while, and is certainly not fixing these things for us InfoSec folks. https://www.oracle.com/technetwork/database/security/tde-faq-093689.html https://www.oracle.com/technetwork/database/security/tde-faq...
- briffle 8y agoThere are a LOT of companies that can't run that, since it requires Enterprise Edition of Oracle.. That is a huge jump in price over standard edition, even for most larger companies.
- bogomipz 8y agoI don't see how encryption at rest helps with an online attack. Once the file system is mounted the filesystem is unlocked. This is way things like LUKS which has bee around forever work today.
- jjeaff 8y agoHopefully someone in the security industry can chime in, but from the outside, it looks like a gold rush is well underway. Unfortunately, the parties that are cashing in are large companies like McAfee that are offering essentially useless "hacker protection" plans. Then on the enterprise side, the big service providers are providing similar useless services. Security is a complex issue that requires custom, expensive, and ongoing solutions. So companies run by non-security professionals are going to trust the relatively cheap programs offered by these large providers.
- ummonk 8y agoNah, not really much of a gold rush. There is a lot of talk about how security is becoming extremely important, but when push comes to shove and companies have to spend significantly to secure their systems, or worse, slow down feature development to do so, they choose the easy route. And I can't blame them, given the financial incentives at play. Take startups. Having a security breach won't kill your startup. Being slow to market will.
- nikanj 8y agoThe ROI is not there, when there are significant costs to security, and no repercussions after getting hacked. Without a solid ROI, it probably won't turn into a gold rush anytime soon.
- eftychis 8y agoI think the issue is a bit more fundamental: Security is an afterthought. There are no repercussions, or gain or expected real punishment for not providing a secure solution. These hacker protection plans are just to tick off a box and satisfy a regulation (government or internal). On the other hand if we cared about security we would not rush to assign a long lasting hard to change number to a person, and share it around... (Or worse in the case of SSN (for the U.S.) pick a number that is neither randomly assigned nor equipped with a validation mechanism.)
- grouseway 8y agoTotally naive question, but how does this work? I have trouble seeing the extra security value. Does "select passport from customers" no longer work as a query? Or do you store an encrypted value in the table that you then decrypt on demand? Is the decryption performed by a microservice that add an additional layer that would need to be hacked?
- mkoryak 8y agoIt works pretty much as described. Now the hackers cant simply steal the db dump, they must also steal the decryption code and the key. This requires more work. The application servers are not the same as database servers, etc.
- saidajigumi 8y ago> Or do you store an encrypted value in the table that you then decrypt on demand? Is the decryption performed by a microservice that add an additional layer that would need to be hacked? That is precisely one model. In fact, there are hardened "vault" appliances designed for exactly this class of use cases. All sensitive PII is 1) encrypted on the vault and 2) replaced externally with a random token. Most of the time, the rule is that the plaintext PII is never removed from the vault. E.g. to compare a value, a new one is sent to the vault to (idempotently) to retrieve a token. Done right, this gives you other features/requirements such as the ability to rate limit and set alarms on vault accesses. E.g. if someone were trying to brute-force retrieve vault data via token retrieval.
- theseatoms 8y agoThe costs of hacks are still largely external, while the costs of avoiding such hacks are high and internal.
- tibbon 8y agoI personally find that people in product, sales, upper management, etc... want to push for features, things being easy/fast, etc over everything else. They tell developers to "not worry about it" and force deadlines on them that don't allow for doing things right.
- duxup 8y agoThe sheer volume of folks in that industry who have borderline ZERO clue is shocking. It really is an amazing mix of absolutely empty suits and good people. Companies seem to have no idea who is who.
- walshemj 8y agoAbsolutely I have seen a major hotel chain totally (no names no pack drill) mess up a site migration - had to revert and do it again after a co worker and I had laid out what they should have done in the first place.
- duxup 8y agoI worked with one when I was an outside vendor. 90% of their IT staff's time was calling up their vendors support teams and convincing them to join a conference call together and then telling vendors from different companies to just make it work, whatever it was. They thought that was just how you did things. Eventually we told them "naw we're not doing that anymore stop eating our support team's time". They threatened to move on to another vendor and tried... but couldn't actually pull it off because... they simply didn't have the manpower or technical knowledge.
- gamma-male 8y agoOk so I know a thing or two about that: 1. Most companies, even large ones, do not encrypt everything. Some do, usually because they have to according to some regulation of the space they operate in (HIPAA for example). 2. Passport numbers are a grey area. Is it public information? Is it private information? 3. Even if you encrypt your database, the key will most often be lying next to it. Unless your company really cares about security, because they have to by design, they will most often not architect an infrastructure that protects the key.
- bdamm 8y ago4. The systems that use the encrypted data are themselves vulnerabilities; if the attacker can collect the data through systems that can decrypt the data for them, then they may not even know that the data was encrypted. Attacks on these kinds of databases are often through services and not by just taking the database wholesale. Thus encryption is not really a robust protection against theft, it only protects against theft via discarded media and the like.
- gamma-male 8y agoGood point as well. Sometimes a SQL injection will go right through this kind of Transparent Database Encryption.
- v_lisivka 8y agoNumbers are too easy to crack by enumeration. You can just enumerate all possible passport numbers, encrypt them, and compare two hashes. It takes seconds on modern CPU. Even if salt is used, all 5E6 records can be cracked in about 2 months on modern desktop, or in 1 day on 60 node cluster.
- gamma-male 8y agoThat’s if you own the encryption key. If you own the encryption key you can just decrypt
- v_lisivka 8y ago
- slifin 8y agolow hanging fruit like "encrypt everything" ...what? A database stops working as a database if you encrypt every field If you encrypt at rest/in transit (which you should legally) then you're only protected against a very limited set of threats Encryption is not going to save you if you have SQL injection or webserver breech Encryption is good but protects against hardly anything, usually physical attacks, do not try and encrypt at the application level, password fields are encrypted because you should never need to query it Passwords are the exception not the rule
- 40acres 8y agoI'm not a security export, so "encrypt everything" is simply a hand-wavy way to say "handle low hanging security holes". When you look at the cause of some of the large breaches in the past, many times they are very simple attack vectors and weak protections: phishing, passwords stored in plaintext, etc. As engineers, we are awed when flaws like Rowhammer and Spectre are exposed, but the fact is that a lot more data is being exposed by very simple means. The fact that corporations are still being breached by these efforts is troubling. I think it shines a bad light on both corporate entities and security consultants.
- LinuxBender 8y agoAt my workplace, all attributes in the database are encrypted. In fact, we are contractually obligated to do so. This does not limit the use of the database. Rather, it changes how we use the database. i.e. We decrypt, store working sets in memory, re-encrypt prior to storing in the database.
- idontpost 8y agoThat's impractical for the vast majority of use cases. The performance costs would be enormous, turning millisecond response times into seconds in many cases.
- LinuxBender 8y agoFor existing database design for many, sure. This requires rethinking how you access your data and changing the architecture and data flows accordingly. I am not in any way suggesting it would be trivial for existing applications to suddenly do this. It requires forethought.
- wonderwonder 8y agoUnfortunately in the hotel and timeshare industry (large overlap) IT is not a central concern it is an expense and often treated as one. Meaning large portions of the system development is outsourced to dev shops out of the country or teams are brought in from India etc. This is not a slight on those engineers as they are often highly skilled. The issue is that they are working off of requirements produced by senior management level people who are very lacking in knowing the low level details. The engineers also don't have the background on what is a surprisingly complicated process and things get lost. These engineering teams were brought in to save money and as such corners are often cut everywhere especially security. The engineers are also often not in a position to push back as they are contractors from poorer nations and rely on these salaries to a far greater degree than a US citizen might.
- eeeeeeeeeeeee 8y agoWhy would it be? There is almost no risk to ignoring security issues, and the risk only decreases the more this happens to other companies because consumers start seeing it as normal behavior that affects all companies they do business with. I'm almost certain Marriott has security people telling the higher-ups that they need to do X to protect security, but if other companies are not subjected to that same risk, revenue growth is always going to win over security. This will never change until governments start holding these companies liable with severe penalties that are not simply "the cost of doing business."