4 ms·

This has far more potentially far-reaching connotations than the BA fine. Yes, Marriot failed to conduct proper due diligence. Yes, they should have been able

by bostik 7y ago

This has far more potentially far-reaching connotations than the BA fine. Yes, Marriot failed to conduct proper due diligence. Yes, they should have been able to detect the breach earlier and block the attackers' access. And yes, the attackers managed to stay in their system for a very, very long time. But this breach was conducted by a nation state adversary. An attacker with unlimited resources and the best technical knowledge on the planet. If inability to protect yourself from such a threat becomes an offense, I am not sure the net effect is positive.

tialaramex 7y ago
Where are you seeing a nation state adversary? I wasn't able to find any mention of this. It's _annoyingly_ common for those who are subject to fairly ordinary attacks to blame a powerful adversary based on very thin evidence, because "The state of Russia attacked my business" sounds like you couldn't be expected to resist whereas "A bored 14 year old attacked my business" sounds like you're useless.
- bostik 7y ago
  This is one of those where the nature of the attack and inference together make the case. The attackers were inside the system for several years. Marriott is a high-end hotel chain, whose establishments are used by state level travelers. Having ongoing access to politicians' and high-ranking corporate executives' itineraries, and especially their hotel room bookings, is an incredible avenue for espionage. A financially motivated attacker would have tried to exfiltrate otherwise valuable data. But if the main target is the travel information data itself, and if the scope does not particularly expand over time, I am going to call it advanced espionage.
  - Raidion 7y ago
    In addition to that, while we know data was taken, it hasn't shown up in any of the customary haunts for stolen information. Someone got access, and squirreled away the data. Just some hacker looking to make some money from identity theft would be selling that left and right.
- joejerryronnie 7y ago
  The bored 14 year old was subcontracted by the state of Russia.
Nasrudith 7y ago
Marriot has time travel technology? The breach happened before acquisition by Marriott. Their failure to discover it before and take sufficient action subsequently is what got them in trouble.
Too 7y ago
Even worse when it's a nation state getting hold of records where their political enemies are spending their hotel nights, and who else was there same night.
marcus_holmes 7y ago
If Marriot can prove that they anonymised the data wherever possible, deleted all the data that they didn't absolutely need, took all possible steps to prevent the attack, and took all the required steps once they detected the breach, then they won't be facing huge fines. The fines aren't for "having a breach", the fines are for mismanagement of their customer's data and negligence around the breach. It's not the inability to protect yourself that's the offence, it's not doing the right thing in the event of a breach that's the offence.
stupidcar 7y ago
The requirement of GDPR is not "don't get hacked", it's "take reasonable steps not to get hacked". If you take reasonable security measures and still get breached, you aren't liable.
Traster 7y ago
Put this on its head: Nation states are attacking our businesses. That makes it absolutely essential to make sure our country's businesses are properly prepared for the threat. Think of it like building an apartment block in San Francisco without adequate Earthquake protection - not only is it bad engineering, it's illegal.

by bostik 7y ago

tialaramex 7y ago

Where are you seeing a nation state adversary? I wasn't able to find any mention of this. It's _annoyingly_ common for those who are subject to fairly ordinary attacks to blame a powerful adversary based on very thin evidence, because "The state of Russia attacked my business" sounds like you couldn't be expected to resist whereas "A bored 14 year old attacked my business" sounds like you're useless.

bostik 7y ago
This is one of those where the nature of the attack and inference together make the case. The attackers were inside the system for several years. Marriott is a high-end hotel chain, whose establishments are used by state level travelers. Having ongoing access to politicians' and high-ranking corporate executives' itineraries, and especially their hotel room bookings, is an incredible avenue for espionage. A financially motivated attacker would have tried to exfiltrate otherwise valuable data. But if the main target is the travel information data itself, and if the scope does not particularly expand over time, I am going to call it advanced espionage.
- Raidion 7y ago
  In addition to that, while we know data was taken, it hasn't shown up in any of the customary haunts for stolen information. Someone got access, and squirreled away the data. Just some hacker looking to make some money from identity theft would be selling that left and right.
joejerryronnie 7y ago
The bored 14 year old was subcontracted by the state of Russia.

Nasrudith 7y ago

Marriot has time travel technology? The breach happened before acquisition by Marriott. Their failure to discover it before and take sufficient action subsequently is what got them in trouble.

Too 7y ago

Even worse when it's a nation state getting hold of records where their political enemies are spending their hotel nights, and who else was there same night.

marcus_holmes 7y ago

If Marriot can prove that they anonymised the data wherever possible, deleted all the data that they didn't absolutely need, took all possible steps to prevent the attack, and took all the required steps once they detected the breach, then they won't be facing huge fines. The fines aren't for "having a breach", the fines are for mismanagement of their customer's data and negligence around the breach. It's not the inability to protect yourself that's the offence, it's not doing the right thing in the event of a breach that's the offence.

stupidcar 7y ago

The requirement of GDPR is not "don't get hacked", it's "take reasonable steps not to get hacked". If you take reasonable security measures and still get breached, you aren't liable.

Traster 7y ago

Put this on its head: Nation states are attacking our businesses. That makes it absolutely essential to make sure our country's businesses are properly prepared for the threat. Think of it like building an apartment block in San Francisco without adequate Earthquake protection - not only is it bad engineering, it's illegal.