4 ms·
I think it's fair to say that these problems shouldn't be blamed on individuals, but systemic failure. In my imagination, someone should have seen this at some
by spijdar 6y ago
I think it's fair to say that these problems shouldn't be blamed on individuals, but systemic failure. In my imagination, someone should have seen this at some point. The system should have had safeguards to ensure that, regardless of any individual's personal failures.
That said, I agree it's a little harsh, since there's no evidence that anyone else could/has done better in this incident.
- 0xy 6y agoWhy shouldn't it be blamed on the person directly responsible? In this case, the VP of Security and/or the CEO?
- Pokepokalypse 6y agoI'm not sure who would be to blame; but in my case, my former employer is still digging themselves out. 2 years ago, I was shown their Solarwinds console, and I thought it had neat pretty graphs. They asked me to set it up for an additional production database, and I told them how risky this was. As usual; I'm deemed the paranoid one, and they said to do it anyway, and being the good worker I am, and NOT a security specialist, I did it. I left there 2 months later for a different job, and TBH - this was one of the many reasons I didn't want to work there anymore, and I stated as such in my exit interview. Now at the end of the day, the IT director signed-off on our HIPAA certification. I'm not exactly sure which of the 800+ security controls Solar Winds violates off the top of my head. But for him to sign a document that says; "we comply with all of these controls" - when it wasn't true, makes him LEGALLY culpable. And believe it or not - penalties for negligence under HIPAA are fucking hardcore. I doubt they'll be charged though.