8 ms·

A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Au

A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest integrity and tightest scrutiny. This seems an opportunity for both internal and external auditors to tighten their game. Outside of audit, surely an employee might have noticed? Was there no formal method to speak up without fear of recrimination? According to Wikipedia [1] there are eighteen thousand employees. Someone never noticed? This seems an organsiational failing, not a technical one. [1] https://en.wikipedia.org/wiki/First_American_Corporation https://en.wikipedia.org/wiki/First_American_Corporation

TomVDB 7y ago
You can access documents all the way back to 2003. That doesn’t necessarily mean that this hole has existed that long.
- zhte415 7y ago
  Very good point.
toong 7y ago
And this is from a huge organisation. There are many more medium-large organisations that still operate under the Chinese-walls model: perimeter defense, but once you are inside the VPN/intranet the security is a lot more relaxed (if any). That is the security culture and very hard to change. The market forces those orgs to start offer services online. They run those (relaxed security) services inside their intranet, so they start poking holes in their firewall. The next decade is not going to be pretty in that regard.
- zhte415 7y ago
  I think you're correct, that these will become more common. A couple of years ago I was chatting with friends who were doing APIs, because of market/regulatory pressure EU's PSD2, exporting JSON of transactions using COBOL for use in online. Because that bank - almost an order of magnitude larger than First American in terms of employees - will do everything in order to not move off COBOL / it's legacy system. Interesting skill set: COBOL, DB2, JS, Angular.
jordanbeiber 7y ago
Is not the tech a part of the organizations way of doing business? These things are highly related to what’s going down in a thread [1] from yesterday (about “shitty projects”). I’m sure these guys spend many millions each year on security products, but either people in the know on the tech side is ignored, or they have no competencies left. In the thread I mention above I have actually posted about my general experience from a major insurance player. A concrete example: We were making changes to a custom software and as there were concerns about bandwidth requirements and latency I took it upon myself to figure out what a specific process looked like, from the business perspective. In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it... This was in the time when a lot of these “lost usb devices” and hacked systems seemed to pop up daily. I obviously raised this with the security team, the security officer and the business unit. No one wanted to touch this finely tuned business process. It felt like I was working at fawlty towers. Again, that companies have drawn this line between business and tech, “‘cause tech is not core bidniz”, will haunt a lot of big players for years to come. [1] https://news.ycombinator.com/item?id=19998806 https://news.ycombinator.com/item?id=19998806
- zhte415 7y ago
  > In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it... That's a manually initiated transaction done internally and should be a red flag to anyone. Data outside of the organisation is data with no control. You could keep escalating this. That's an example of no 'speaking up' channel. If a channel to escalate is missing or poorly implemented, frauds will happen by internal or external agents. The process doesn't sound finely tuned at all.
  - jordanbeiber 7y ago
    Of course I was being ironic about it being ”finely tuned”! What I’m saying is that in spite of having, in a sense, all the resources at their disposal, this process was chosen by the business, for the business. An encrypted on-line service could, and should, have been implemented. But being far from tech & dev the business choose a process matching their compentecies. Messing with this several years in, and trying to digitize a process obviously in need for it, is met with much resistance. Another gem of a process: Many (like hundreds) employees needed personal printers. But why?! Because: - printing claim from “modern” client/server system. - Pinning an also printed bar-code to the pages from step one - scanning these in to software that reads the bar-code and adds them to queues for mainframe processing. D/A -> A/D? Huh?! Holy cow! I almost fell off my chair... And the inherent security risks in play here, not to mention acres of forrest consumed during the years. My mind is boggling... Am I actually living my working life inside a Dilbert strip?! It’s not even funny, because it’s true. What I’m saying is that many large corps are anything but in fine tune with tech. It’s gonna’ cost em’ in the long run.
nerdponx 7y ago
You know what's a great incentive to actually care about this stuff? Legal consequences for not caring about it. Anyone conceivably responsible for ignoring the developer's complaint should be on trial right now.
- mcny 7y ago
  I personally think the board and CEO should be personally criminally liable. I don't know exactly how but if I can't use ignorance of the law as a defense for shouting in public (one yell back at someone who yelled "fuck you" at me and I got a $180 fine) then the CEO and board can't use that as a defense for leaking data for SIXTEEN years. Didn't know this was happening in your organization? Fuxk you, go to prison.
- afarrell 7y ago
  As an American resident in Europe, I have to wonder what liability they face under GDPR.

TomVDB 7y ago

You can access documents all the way back to 2003. That doesn’t necessarily mean that this hole has existed that long.

zhte415 7y ago
Very good point.

toong 7y ago

And this is from a huge organisation. There are many more medium-large organisations that still operate under the Chinese-walls model: perimeter defense, but once you are inside the VPN/intranet the security is a lot more relaxed (if any). That is the security culture and very hard to change. The market forces those orgs to start offer services online. They run those (relaxed security) services inside their intranet, so they start poking holes in their firewall. The next decade is not going to be pretty in that regard.

zhte415 7y ago
I think you're correct, that these will become more common. A couple of years ago I was chatting with friends who were doing APIs, because of market/regulatory pressure EU's PSD2, exporting JSON of transactions using COBOL for use in online. Because that bank - almost an order of magnitude larger than First American in terms of employees - will do everything in order to not move off COBOL / it's legacy system. Interesting skill set: COBOL, DB2, JS, Angular.

jordanbeiber 7y ago

Is not the tech a part of the organizations way of doing business? These things are highly related to what’s going down in a thread [1] from yesterday (about “shitty projects”). I’m sure these guys spend many millions each year on security products, but either people in the know on the tech side is ignored, or they have no competencies left. In the thread I mention above I have actually posted about my general experience from a major insurance player. A concrete example: We were making changes to a custom software and as there were concerns about bandwidth requirements and latency I took it upon myself to figure out what a specific process looked like, from the business perspective. In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it... This was in the time when a lot of these “lost usb devices” and hacked systems seemed to pop up daily. I obviously raised this with the security team, the security officer and the business unit. No one wanted to touch this finely tuned business process. It felt like I was working at fawlty towers. Again, that companies have drawn this line between business and tech, “‘cause tech is not core bidniz”, will haunt a lot of big players for years to come. [1] https://news.ycombinator.com/item?id=19998806 https://news.ycombinator.com/item?id=19998806

zhte415 7y ago
> In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it... That's a manually initiated transaction done internally and should be a red flag to anyone. Data outside of the organisation is data with no control. You could keep escalating this. That's an example of no 'speaking up' channel. If a channel to escalate is missing or poorly implemented, frauds will happen by internal or external agents. The process doesn't sound finely tuned at all.
- jordanbeiber 7y ago
  Of course I was being ironic about it being ”finely tuned”! What I’m saying is that in spite of having, in a sense, all the resources at their disposal, this process was chosen by the business, for the business. An encrypted on-line service could, and should, have been implemented. But being far from tech & dev the business choose a process matching their compentecies. Messing with this several years in, and trying to digitize a process obviously in need for it, is met with much resistance. Another gem of a process: Many (like hundreds) employees needed personal printers. But why?! Because: - printing claim from “modern” client/server system. - Pinning an also printed bar-code to the pages from step one - scanning these in to software that reads the bar-code and adds them to queues for mainframe processing. D/A -> A/D? Huh?! Holy cow! I almost fell off my chair... And the inherent security risks in play here, not to mention acres of forrest consumed during the years. My mind is boggling... Am I actually living my working life inside a Dilbert strip?! It’s not even funny, because it’s true. What I’m saying is that many large corps are anything but in fine tune with tech. It’s gonna’ cost em’ in the long run.

nerdponx 7y ago

You know what's a great incentive to actually care about this stuff? Legal consequences for not caring about it. Anyone conceivably responsible for ignoring the developer's complaint should be on trial right now.

mcny 7y ago
I personally think the board and CEO should be personally criminally liable. I don't know exactly how but if I can't use ignorance of the law as a defense for shouting in public (one yell back at someone who yelled "fuck you" at me and I got a $180 fine) then the CEO and board can't use that as a defense for leaking data for SIXTEEN years. Didn't know this was happening in your organization? Fuxk you, go to prison.
afarrell 7y ago
As an American resident in Europe, I have to wonder what liability they face under GDPR.