4 ms·

> This is a wild exaggeration. It isn't. I get that experience as a pentester can make you jaded to security practices, but the healthcare space is extremely r

> This is a wild exaggeration. It isn't. I get that experience as a pentester can make you jaded to security practices, but the healthcare space is extremely regulated and much of what the grandparent said is a direct result of that. > Secondly, this seems to be a straightforward database misconfiguration. The database was set to public with no restrictions. It likely wasn't accessible to anyone who wasn't explicitly looking for it, i.e. security researchers or black hats. Yes, this was horrible, but nothing bad happened here. The database was simply set to private. This isn't just a minor misconfiguration. Again, this is a regulated space, with rules. There should be multiple layers in place to make sure that this is not opened to the public. There's risk assessments that needed to be carried out when the database was launched, and on a regular cadence afterwards. "It wasn't accessible to anyone who wasn't explicitly looking for it" isn't reassuring. Look at access logs on any device with a public IP address and it's clear that people are constantly looking. > But no, you're not personally liable if a fuckup happens. Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations. > But you also take your job way too seriously. Bad. People working in this space are required to have regular training and undergo audits of their activity, what information they access, risk assessments on how it is stored, and long, drawn out compliance activities just to get access.

kspacewalk2 6y ago
>Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations. Has anyone ever been actually sent to jail under HIPAA for something comparable to an honest DB config mistake? Has anyone been credibly threatened with it in the court of law? Has anyone come remotely close?
- sillysaurusx 6y ago
  Nope. Definitely not rank-and-file engineers. Suppose you fucked up, and the worst happened: You were the reason the database was misconfigured. What then? Then you live your life. You think future employers are going to pass on you because of it? Maybe some would. Most don't give a shit. They care about one thing and one thing only: whether you can help them achieve their objectives. Morals are a fine thing, but the reality is that the original comment was correct: Nothing will happen to these people. As it should be. They are required under law to notify the affected people. THat's the extent of what will happen. There may be legal repercussions for the company. And I'm sure the engineers will feel pretty awful at this mistake. I know I would. Everyone does. But that doesn't change the fact that the world is insecure.
- parliament32 6y ago
  Not even close. The only case I could see it happening was if you purposefully exfiltrated data and sold it, or got some sort of personal gain out of it. It's the same thing with PCI. They say you can go to jail for violations but exactly 0 people have ever been prosecuted, despite constant negligence in the payment industry.
cutemonster 6y ago
> Look at access logs on any device with a public IP address and it's clear that people are constantly looking Yes, I'd be a bit surprised if this database hadn't already been detected by some automatic IP and port scanning scripts, and the wrong people found out about it (I don't with exactly these things though do I might be mistaken)
deleted 6y ago
[deleted]

kspacewalk2 6y ago

>Under HIPAA, you can be held personally liable. This includes jail time for certain classes of violations. Has anyone ever been actually sent to jail under HIPAA for something comparable to an honest DB config mistake? Has anyone been credibly threatened with it in the court of law? Has anyone come remotely close?

sillysaurusx 6y ago
Nope. Definitely not rank-and-file engineers. Suppose you fucked up, and the worst happened: You were the reason the database was misconfigured. What then? Then you live your life. You think future employers are going to pass on you because of it? Maybe some would. Most don't give a shit. They care about one thing and one thing only: whether you can help them achieve their objectives. Morals are a fine thing, but the reality is that the original comment was correct: Nothing will happen to these people. As it should be. They are required under law to notify the affected people. THat's the extent of what will happen. There may be legal repercussions for the company. And I'm sure the engineers will feel pretty awful at this mistake. I know I would. Everyone does. But that doesn't change the fact that the world is insecure.
parliament32 6y ago
Not even close. The only case I could see it happening was if you purposefully exfiltrated data and sold it, or got some sort of personal gain out of it. It's the same thing with PCI. They say you can go to jail for violations but exactly 0 people have ever been prosecuted, despite constant negligence in the payment industry.

cutemonster 6y ago

> Look at access logs on any device with a public IP address and it's clear that people are constantly looking Yes, I'd be a bit surprised if this database hadn't already been detected by some automatic IP and port scanning scripts, and the wrong people found out about it (I don't with exactly these things though do I might be mistaken)

deleted 6y ago

[deleted]