6 ms·

This is a wild exaggeration. First of all, everyone is insecure. Work as a pentester, and you'll see that the whole world is insecure. After the 30th project wi

This is a wild exaggeration. First of all, everyone is insecure. Work as a pentester, and you'll see that the whole world is insecure. After the 30th project with an SQL injection vuln or misconfiguration, you'll never be phased again. Secondly, this seems to be a straightforward database misconfiguration. The database was set to public with no restrictions. It likely wasn't accessible to anyone who wasn't explicitly looking for it, i.e. security researchers or black hats. Yes, this was horrible, but nothing bad happened here. The database was simply set to private. Third, my friend, chillax a bit. Yes, it's extraordinarily important to protect people's medical data. But no, you're not personally liable if a fuckup happens. Everyone fucks up. That's why the fuckups are covered by legal protections. You take your job seriously. Good! But you also take your job way too seriously. Bad. You're gonna burn yourself out within a decade with this mindset. None of this is to say that what happened didn't matter. Of course it matters. But you are literally saying you'd be begging to be let into prison. That's not proportionate, and feels like a reflection of the current social climate of retribution-as-forgiveness.

pc86 6y ago
What's more, it's important to take in the context of the data. It's not mental health, or HIV status, or sexual history, or really of any nature that can do damage other than the privacy aspect. It's people who hurt their neck after a car accident. Not the most sensitive stuff in the world. Just to be explicit about it, I'm not suggesting the release of this data isn't a problem. Just that as medical data goes this is about an innocuous as it could have been. Even day-to-day visits to your primary care doc would probably have references to much more sensitive health data.
- nitrogen 6y ago
  It's more sensitive than you'd think if any claims or settlements were involved. Or employers might want to snoop on their injured employees to find a reason to deny leave.
- deleted 6y ago
  [deleted]
cb504 6y ago
If I understood correctly, the database was on a publicly accessible network. Wouldn't the problem be averted by putting the database in a separate VLAN, where only specific IP's from the public VLAN could access it, and not IP's from WWW??
- francis-io 6y ago
  You could secure it in a number of ways, including the way you mention. Unfortunately, it seems like security is no ones top concern unless they are forced to handle it correctly.
- parliament32 6y ago
  That's not really what VLANs are for, you'd probably just use firewall rules to restrict access to certain IPs. VLANs are more for creating virtual-networks-inside-networks, they're more organization-based than security-based.
mirashii 6y ago
> This is a wild exaggeration. It isn't. I get that experience as a pentester can make you jaded to security practices, but the healthcare space is extremely regulated and much of what the grandparent said is a direct result of that. > Secondly, this seems to be a straightforward database misconfiguration. The database was set to public with no restrictions. It likely wasn't accessible to anyone who wasn't explicitly looking for it, i.e. security researchers or black hats. Yes, this was horrible, but nothing bad happened here. The database was simply set to private. This isn't just a minor misconfiguration. Again, this is a regulated space, with rules. There should be multiple layers in place to make sure that this is not opened to the public. There's risk assessments that needed to be carried out when the database was launched, and on a regular cadence afterwards. "It wasn't accessible to anyone who wasn't explicitly looking for it" isn't reassuring. Look at access logs on any device with a public IP address and it's clear that people are constantly looking. > But no, you're not personally liable if a fuckup happens. Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations. > But you also take your job way too seriously. Bad. People working in this space are required to have regular training and undergo audits of their activity, what information they access, risk assessments on how it is stored, and long, drawn out compliance activities just to get access.
- kspacewalk2 6y ago
  >Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations. Has anyone ever been actually sent to jail under HIPAA for something comparable to an honest DB config mistake? Has anyone been credibly threatened with it in the court of law? Has anyone come remotely close?
  - sillysaurusx 6y ago
    Nope. Definitely not rank-and-file engineers. Suppose you fucked up, and the worst happened: You were the reason the database was misconfigured. What then? Then you live your life. You think future employers are going to pass on you because of it? Maybe some would. Most don't give a shit. They care about one thing and one thing only: whether you can help them achieve their objectives. Morals are a fine thing, but the reality is that the original comment was correct: Nothing will happen to these people. As it should be. They are required under law to notify the affected people. THat's the extent of what will happen. There may be legal repercussions for the company. And I'm sure the engineers will feel pretty awful at this mistake. I know I would. Everyone does. But that doesn't change the fact that the world is insecure.
stjohnswarts 6y ago
Sorry you're the one wildly exaggerating about its importance. 2.5 million people wouldn't agree with your take on this. This stuff should never be public facing. It should be behind several layers of security not sitting on a public facing server without any protection. The people screwing this should be heavily fined and not be able to work on anything internet facing for several years while they have the time to learn a bit of network security if it does turn out to be gross incompetence/negligence.

pc86 6y ago

What's more, it's important to take in the context of the data. It's not mental health, or HIV status, or sexual history, or really of any nature that can do damage other than the privacy aspect. It's people who hurt their neck after a car accident. Not the most sensitive stuff in the world. Just to be explicit about it, I'm not suggesting the release of this data isn't a problem. Just that as medical data goes this is about an innocuous as it could have been. Even day-to-day visits to your primary care doc would probably have references to much more sensitive health data.

nitrogen 6y ago
It's more sensitive than you'd think if any claims or settlements were involved. Or employers might want to snoop on their injured employees to find a reason to deny leave.
deleted 6y ago
[deleted]

cb504 6y ago

If I understood correctly, the database was on a publicly accessible network. Wouldn't the problem be averted by putting the database in a separate VLAN, where only specific IP's from the public VLAN could access it, and not IP's from WWW??

francis-io 6y ago
You could secure it in a number of ways, including the way you mention. Unfortunately, it seems like security is no ones top concern unless they are forced to handle it correctly.
parliament32 6y ago
That's not really what VLANs are for, you'd probably just use firewall rules to restrict access to certain IPs. VLANs are more for creating virtual-networks-inside-networks, they're more organization-based than security-based.

mirashii 6y ago

> This is a wild exaggeration. It isn't. I get that experience as a pentester can make you jaded to security practices, but the healthcare space is extremely regulated and much of what the grandparent said is a direct result of that. > Secondly, this seems to be a straightforward database misconfiguration. The database was set to public with no restrictions. It likely wasn't accessible to anyone who wasn't explicitly looking for it, i.e. security researchers or black hats. Yes, this was horrible, but nothing bad happened here. The database was simply set to private. This isn't just a minor misconfiguration. Again, this is a regulated space, with rules. There should be multiple layers in place to make sure that this is not opened to the public. There's risk assessments that needed to be carried out when the database was launched, and on a regular cadence afterwards. "It wasn't accessible to anyone who wasn't explicitly looking for it" isn't reassuring. Look at access logs on any device with a public IP address and it's clear that people are constantly looking. > But no, you're not personally liable if a fuckup happens. Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations. > But you also take your job way too seriously. Bad. People working in this space are required to have regular training and undergo audits of their activity, what information they access, risk assessments on how it is stored, and long, drawn out compliance activities just to get access.

kspacewalk2 6y ago
>Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations. Has anyone ever been actually sent to jail under HIPAA for something comparable to an honest DB config mistake? Has anyone been credibly threatened with it in the court of law? Has anyone come remotely close?
- sillysaurusx 6y ago
  Nope. Definitely not rank-and-file engineers. Suppose you fucked up, and the worst happened: You were the reason the database was misconfigured. What then? Then you live your life. You think future employers are going to pass on you because of it? Maybe some would. Most don't give a shit. They care about one thing and one thing only: whether you can help them achieve their objectives. Morals are a fine thing, but the reality is that the original comment was correct: Nothing will happen to these people. As it should be. They are required under law to notify the affected people. THat's the extent of what will happen. There may be legal repercussions for the company. And I'm sure the engineers will feel pretty awful at this mistake. I know I would. Everyone does. But that doesn't change the fact that the world is insecure.

stjohnswarts 6y ago

Sorry you're the one wildly exaggerating about its importance. 2.5 million people wouldn't agree with your take on this. This stuff should never be public facing. It should be behind several layers of security not sitting on a public facing server without any protection. The people screwing this should be heavily fined and not be able to work on anything internet facing for several years while they have the time to learn a bit of network security if it does turn out to be gross incompetence/negligence.