7 ms·

This is quite strong policy. Usually in most sinister incompetent companies, the user name is "admin" and the password is "password". On a serious note: there

• ericmay 7y ago
  Right. We do this with accounting firms, and I think we should do it with data security as well. Does it cost money? Sure. But that's the cost of doing business. If you have personal info like this and you profit from it, then you are also responsible for safeguarding it.
  • pmccarren 7y ago
    In being careful to not build an impossible barrier-to-entry, perhaps the requirement becomes active upon certain criteria (e.g. number of users)
    • zonidjan 7y ago
      There's already an impossible barrier to entry. The ones that already exist have data on almost every person in the US, and your new upstart doesn't.
  • sailfast 7y ago
    Just a quick gut-check: are we sure this is working well with accounting firms? They're all merging again post-Arthur-Anderson scandal with their services consulting businesses and while there may be controls and training and they're all pretty serious about it (I worked for such a company at one point) it doesn't seem like many folks are getting dinged on violations of late. I agree that it is worth the cost (as a citizen whose data is being lost) but in the current landscape the companies may argue that it is not, and might be right.
• VMG 7y ago
  The laws already exist, the penalty is just too small. With higher penalties there would be an insurance market where the insurers set standards and performs audits. Standards set by buerocrats are usually written by special interest groups and don't achieve the desired outcome at a good cost.
  • ed_blackburn 7y ago
    Sadly having been in such an environment, I can confirm that indemnity insurance exists for such situations. What happens is the underwriter to reduce risk mandates a very rigid process. In one case, I saw a "private cloud" provider underwrite their client's system by owning the "software-development-release-cycle". They were mandating quarterly releases and three-month manual testing and regression periods. They put themselves in a situation whereby they could charge the client for the tin, administering the process, the time and materials for the deployment and testing and the indemnity premium. They reduce their risk/exposure because of infrequent releases and such long regression cycles meant assurance levels were rarely met within the dedicated window. There was a very long tail of unreleased features. In summary, they mitigated any risk by chocking the product, reducing the number of releases and the size of them to deliver a fraction of the value available. We learned to work around by taking advantage of feature switching, but quarterly releases are a death knell for a product.
  • PaulHoule 7y ago
    It's a recent trend that public corporations are being punished through securities fraud lawsuits since conventional regulators have been bought out. Just about any managerial incompetence can be spun as "securities fraud" since the basic presumption of most companies is that management is competent. Maybe they'll give up on that in order to reduce their exposure to lawsuits.
• thomascgalvin 7y ago
  Unfortunately this particular genie is already out of the bottle. We can improve security practices going forward, but at this point any American with a credit history has had their personal details compromised.
• Spooky23 7y ago
  No way! A sinister big company would use “Pa$$w0rd” to meet complexity requirements!
  • elisharobinson 7y ago
    sinister != competent
• buboard 7y ago
  i think it's 123456 because users get confused on the phone. - What's the password - password - Yes, the password!
  • bookofjoe 7y ago
    "What's the frequency, Kenneth?" https://en.wikipedia.org/wiki/What%27s_the_Frequency,_Kenneth%3F https://en.wikipedia.org/wiki/What%27s_the_Frequency,_Kennet...
    • omarhaneef 7y ago
      Alternative reference is Spaceballs: Dark Helmet's locker combination.
      • dylan604 7y ago
        Except this one was at least a 6 digit pass code rather than the four digit 1234 from Spaceballs. At least give them that credit?
        • omarhaneef 7y ago
          Good point, that is 10 x 10 = 100 times safer!
• AJ007 7y ago
  There could be whistleblower protections for hackers. Consider the previous attitude was hackers are causing millions of dollars of damage and need to be thrown in prison. With the proliferation of state sponsored and counter intelligence hacking over the past 15 years, no one believes you can make anything secure just by throwing enough teenage script kiddies in federal prison. The reverse now is companies are taking the blame and legal liability for being negligent in their security practices. That said, no organization public or private is impervious. Heartbleed and meltdown should have driven that home to anyone who thinks otherwise. Determining where the line of negligence lays will be a harder one to draw, though for civil liability it may not even matter (which is great for Google, Apple, and death for small businesses.)
  • bigtunacan 7y ago
    While nothing is impervious that really has nothing to do with Equifax. Equifax is a case of gross negligence and malfeasance. There were no less than three security audits of Equifax going back as early as 2014. Every audit indicated major security vulnerabilities and Smith disregarded these audits each time.
    • dmix 7y ago
      Who was paying for the security reviews if they were just going to be ignored? Some management or regulatory process?
      • bigtunacan 7y ago
        A little bit of both. Equifax (and other credit reporting agencies) are subject to an annual audit from the SEC. There were issues being raised from the SEC with Equifax's processes going back to at least 2012. Ernst & Young also had a responsibility of oversight for Equifax's security practices due to acting as Equifax's primary independent auditor with regards to shareholder reporting. Additionally, Equifax then paid on three separate occasions for external security audits at the direction of upper management (one specifically directed by Smith where the auditors were specifically directed to report the results only to Smith). I haven't seen enough information to give a positive answer, but only to make conjecture that the external audits were driven by outside pressures; likely coming from the SEC. So the audits were performed, but this was essentially just a formality and management largely disregarded the audit findings.
• pmccarren 7y ago
  How would one motivate these companies to _actually do something_ with the results of the audit? Perhaps, buried deep in the burrows of their bureaucratic empire, are several audit reports outlining this vulnerability..
• zonidjan 7y ago
  Yes. You can't rely on capitalism to regulate businesses, much less to regulate businesses who deal with the private information of people other than their customers. (See also: Google, Facebook)
  • scarface74 7y ago
    And you can’t trust the government to regulate business either between the revolving door of government and private industry and each party is biased for and against certain industries.
• chapium 7y ago
  Its probably been admin/admin for the past decade as well
  • vectorEQ 7y ago
    since it's using regular admin credz, a lot of prior 'breaches' might even have gone unnoticed, since its likely no alarm bells would have been in place to find authorised access misuse.
• bko 7y ago
  There are two types of possible regulation, one is control and the other is liability. With control, some administrative body says you have to do X, Y and Z. And presumably, if you jump through the hoops and it blows up, there is an implicit guarantee. This kind of regulation is common across banks, and in 2008 when all the reserve requirements were deemed insufficient and all the acceptable ratings meaningless, there was a bailout. The other alternative is a liability approach. You are liable for something (e.g. protection of customer information) and you are responsible for execution in the best way to know possible. If you fail, there is some punitive measure taken. I personally prefer the second, especially since security is a hard problem. There are best practices, sure, but from my experience, I don't believe regulators and auditors are effective in their stated goals.
  • zaarn 7y ago
    I don't see much difference in the two approaches, except the later case will require customers to collectively sue you for damages, in which case you can probably run a cost-benefit analysis to find out if it would be worth it. In a regulatory environment, if a corporation does not comply, the punishment is increased until either the corporation complies or seizes to exist. Since not existing is bad for profit, corporations usually comply eventually. In a liablatory environment, as long as nothing happens, a corporation can continue to proceed down a dark path with no ill effects and abuse the rules as they see fit. It's only costly when things go wrong and you can calculate the likely cost of things going wrong.
    • lmkg 7y ago
      The big operative difference is that under the Control regime, the regulator decides what practices are acceptable. Under the Liability regime, the acceptability of practices depends more directly on their effectiveness (with more or less directness depending on the type of liability). A Liability regime would encourage companies to be actually secure, because they're responsible for what happens to data that is lost. A Control regime would encourage companies to check boxes from a list provided by a regulator. A Liability regime encourages being pro-active vs reactive to the regulator in a Control regime. There are middle grounds, like HIPAA or GDPR. Both give companies some leeway in terms of creating their own checkboxes, and fines are for actual breaches, not just improper process.
• shadowgovt 7y ago
  In a market where Equifax having a critical data breach threatened is bottom line, they'd be incentivized to implement this themselves. A critical data breach doesn't threaten its bottom line. Unless someone uses such a breach to turbo credentials into one of the credit-querying institutions and reveals, for example, the detailed criteria by which such an institution grants a loan.
• sailfast 7y ago
  Determining which organizations should be charged with third-party security audits / regulation in an already complicated regulatory landscape (orgs may already be providing security info to 2-3 regulators in different formats is challenge 1. Challenge 2 is actually getting any legislator / regulator (at least in the United States in the current climate) to agree that this is an important and urgent regulatory matter worth adding the burden to companies', and that they should move on this now to improve overall national security. Challenge 3 is to only make the request once, in a standard format so that the data is actually relevant instead of overlapping requests from different organizations that turn useful data into a paperwork drill that is irrelevant by the time it leaves the org. Lastly, I'd say some sort of open source middleware proof of concept to exchange this information would go a long way toward accountability. Industry could even propose the best option themselves via their existing interest groups.
• Pxtl 7y ago
  It's "Password12345!" to work around the complexity requirements.
• edoceo 7y ago
  I integrate with gov systems, very little PII, but we have to carry heavy insurance and get external audits every three years.
• eyegor 7y ago
  Unfortunately if there were such audits, I can practically guarantee that it would end up being bottom-dollar devs employed through unions or insider dealings. And the larger companies like equifax would likely have a deal allowing them to self audit to some extent. See: Boeing, iso certifications, building inspectors, health inspectors, any large civil engineering or aero firm, etc. To be clear, I do agree that it is absolutely needed in the US. I just have no idea how you could implement it. Culturally the US seems to think that asking forgiveness and looser regulation for businesses is the right direction.
  • jonnycomputer 7y ago
    Not accusing you of this, strictly speaking, but I see this as just more of the "if you regulate, they'll just do X, so don't bother" defeatism that is used all the time to argue against regulation, taxation, or any sort of policing of the rich and powerful. We have numerous examples of regulations actually working as designed. Notable failures (e.g. the IRS, the financial industry in the 2000s) are due in large part to persistent under-funding by Congress, rather than any inherent impossibility.
    • eyegor 7y ago
      Yes, it always comes down to funding. But the major anti regulation party has also been staunchly anti tech regulation for a long time (link below), and even when the major tech companies tried to throw their weight around they lost (see Google et al vs fcc during the repeal of net neutrality). This can also be seen with the recent public appearances of govt harassment/scapegoating of facebook, which looks like "hey, we'd like you to change your rules" while simultaneously not regulating them. I think the first step needs to be a bit of a cultural shift towards regulation again before it will be effective (see epa push after the Ohio River caught fire). I don't mean to say "don't regulate, it's pointless", I mean to say "set it up from the top down, don't try to piggyback data regulation onto a framework that wasn't designed for it". https://en.m.wikipedia.org/wiki/Office_of_Technology_Assessment https://en.m.wikipedia.org/wiki/Office_of_Technology_Assessm...
  • denton-scratch 7y ago
• _bxg1 7y ago
  I think it would be more efficient to give literally any teeth at all to prosecutors in these cases. Make it a big enough liability that they have to care. Let them figure out how to avoid the crippling fines.
• tjpnz 7y ago
  Another approach would be to start fining organizations that leak personal information. If the fine was sufficiently large per individual companies would then be incentivised to start taking security seriously and third party audits would probably be part of that.
• TallGuyShort 7y ago
  I was once pulled in to consult on a new unix system that was being connected to a bank's mainframe. The operator I was working with, who had worked on mainframes his entire career, hesitated and said he needed to call someone because he couldn't remember the password into the unix system. When they didn't answer, I asked if they wanted to try 'root', or something. They did. It worked. Stunned silence followed. They wanted to know how I knew that. Nobody was supposed to know that.
• c3534l 7y ago
  There are external financial audits to provide public information about a company's finances are accurately reported to the public. We need the same thing for security, because there's no real way of assessing that as an outsider and that knowledge is a public good, much like a corporation's finances.