4 ms·

Just a thought, but you don’t store them in an unprotected S3 bucket. If you’re required to handle this kind of sensitive information — for any purpose, but I

Just a thought, but you don’t store them in an unprotected S3 bucket. If you’re required to handle this kind of sensitive information — for any purpose, but I would say this is even more true for anything tied to anything of a sexual nature or anything tied to health — you should take every precaution that that information is secure, encrypted when possible, and that your systems are regularly audited for vulnerabilities. If the onus of properly protecting sensitive data — whether you’re legally required to hold it or not — is too much or too expensive, you shouldn’t be in that type of business. Period.

llampx 7y ago
Until companies are made to feel the pain of data leaks, they won't bother.
- RHSeeger 7y ago
  It's a porn company, not a bank or other "respectable" business, so it's possible that they could actually face consequences. And to counter that, the victims are porn actors/actresses, so the perpetrators probably won't face consequences for it. I'd like to /s this comment, but I'm not sure I can.
  - doublerabbit 7y ago
    I can chime in one as I was a systems administrator for one of those shady “Get sex tonight” dating websites. The law of having to hold the identification of the models is pretty much the only law you need to uphold. These sites are created from shills of shells. You have one company, from there you then have two or three other companies which create white label brands utilising one of the shell companies. So the brand “bangshelia” would be registered with a shell company “adult dating world”. This brand would then be bought by a shill and branded as “purple dating” but registered by a company called “dating purple”. You would then affiliate with “adult dating tonight” where they would provide the data for your brand. To get anywhere near close to chasing the company, you need to launch a lawsuit against the active site, (the company registered to) and then the company behind that and from that the company providing the database. Which all costs money. As my CEO did, you pack up shop on one of those brands and rebrand yourself. Claim your not associated to the previous company by registering another director. There are no resources available to attempt to make anything secure. The website of the company I used to work for kept all passwords in plain text in a database that was accessible online publicly for other affiliates to borrow to create their own “brand”.
    - TJSomething 7y ago
      It took me a couple reads, but do you mean "shell" (as in a shell company that does nothing but exist to protect or obscure the operations of another company) instead of "shill" (a person who markets for someone while hiding that they are associated with them)?
      - doublerabbit 7y ago
        Sorry about that, I’ve rehashed what I wrote and should now make more sense. It’s shill of shells. The CEO makes one company, another “investor” buys a brand of the original company and registers it in their name and then sells that on.
- fooey 7y ago
  The Experian settlement pretty well solidified security as a waste of money.
HenryBemis 7y ago
I watched "Laundromat" (*movie about the Panama Papers), towards the end of the movie, Antonio Banderas says: "In... In retrospect, uh... I think we... we could have spent more on cyber-security."
- deleted 7y ago
  [deleted]
dragonwriter 7y ago
> Just a thought, but you don’t store them in an unprotected S3 bucket. That's pretty much a good rule of thumb for, well, everything. (Sure, there are exceptions. But, there's a reason AWS not only doesn't enable public access to buckets by default, but actually by default has superceding policies in place which block setting normal policies to allow public access; it's almost always the wrong choice.)
ben509 7y ago
> Just a thought, but you don’t store them in an unprotected S3 bucket. > If you’re required to handle this kind of sensitive information ... you should take every precaution that that information is secure, encrypted when possible, and that your systems are regularly audited for vulnerabilities. None of that solves the problem, though. You can protect an S3 bucket, but anyone who wants it simply checks it periodically. Then one day someone is working with the data and changes the permissions to get access, and before they know it, it's downloaded in minutes. It just takes one attacker to get lucky and catch it before your audits do. And S3 is not unusual, it's just an Internet service like any other, they all have this problem. Even if you have your own data center on a private network, it's only private until someone needs to transmit something and opens a route. It's ultimately a human problem, there's no magic that can prevent it. > If the onus ... you shouldn’t be in that type of business. Period. Ending an unjustified opinion with "period" highlights the fact that you didn't justify the opinion. And it sounds fatuous.
- tendencydriven 7y ago
  If you're changing the permissions to public just to work with the data, there's your problem. Proper access policies solves all of this - the bucket should never have had public access enabled in the first place as there is literally zero need for it, just sloppy work.

llampx 7y ago

Until companies are made to feel the pain of data leaks, they won't bother.

RHSeeger 7y ago
It's a porn company, not a bank or other "respectable" business, so it's possible that they could actually face consequences. And to counter that, the victims are porn actors/actresses, so the perpetrators probably won't face consequences for it. I'd like to /s this comment, but I'm not sure I can.
- doublerabbit 7y ago
  I can chime in one as I was a systems administrator for one of those shady “Get sex tonight” dating websites. The law of having to hold the identification of the models is pretty much the only law you need to uphold. These sites are created from shills of shells. You have one company, from there you then have two or three other companies which create white label brands utilising one of the shell companies. So the brand “bangshelia” would be registered with a shell company “adult dating world”. This brand would then be bought by a shill and branded as “purple dating” but registered by a company called “dating purple”. You would then affiliate with “adult dating tonight” where they would provide the data for your brand. To get anywhere near close to chasing the company, you need to launch a lawsuit against the active site, (the company registered to) and then the company behind that and from that the company providing the database. Which all costs money. As my CEO did, you pack up shop on one of those brands and rebrand yourself. Claim your not associated to the previous company by registering another director. There are no resources available to attempt to make anything secure. The website of the company I used to work for kept all passwords in plain text in a database that was accessible online publicly for other affiliates to borrow to create their own “brand”.
  - TJSomething 7y ago
    It took me a couple reads, but do you mean "shell" (as in a shell company that does nothing but exist to protect or obscure the operations of another company) instead of "shill" (a person who markets for someone while hiding that they are associated with them)?
    - doublerabbit 7y ago
      Sorry about that, I’ve rehashed what I wrote and should now make more sense. It’s shill of shells. The CEO makes one company, another “investor” buys a brand of the original company and registers it in their name and then sells that on.
fooey 7y ago
The Experian settlement pretty well solidified security as a waste of money.

HenryBemis 7y ago

I watched "Laundromat" (*movie about the Panama Papers), towards the end of the movie, Antonio Banderas says: "In... In retrospect, uh... I think we... we could have spent more on cyber-security."

deleted 7y ago
[deleted]

dragonwriter 7y ago

> Just a thought, but you don’t store them in an unprotected S3 bucket. That's pretty much a good rule of thumb for, well, everything. (Sure, there are exceptions. But, there's a reason AWS not only doesn't enable public access to buckets by default, but actually by default has superceding policies in place which block setting normal policies to allow public access; it's almost always the wrong choice.)

ben509 7y ago

> Just a thought, but you don’t store them in an unprotected S3 bucket. > If you’re required to handle this kind of sensitive information ... you should take every precaution that that information is secure, encrypted when possible, and that your systems are regularly audited for vulnerabilities. None of that solves the problem, though. You can protect an S3 bucket, but anyone who wants it simply checks it periodically. Then one day someone is working with the data and changes the permissions to get access, and before they know it, it's downloaded in minutes. It just takes one attacker to get lucky and catch it before your audits do. And S3 is not unusual, it's just an Internet service like any other, they all have this problem. Even if you have your own data center on a private network, it's only private until someone needs to transmit something and opens a route. It's ultimately a human problem, there's no magic that can prevent it. > If the onus ... you shouldn’t be in that type of business. Period. Ending an unjustified opinion with "period" highlights the fact that you didn't justify the opinion. And it sounds fatuous.

tendencydriven 7y ago
If you're changing the permissions to public just to work with the data, there's your problem. Proper access policies solves all of this - the bucket should never have had public access enabled in the first place as there is literally zero need for it, just sloppy work.