8 ms·

Somewhat off topic but this is actually pretty positive proactive approach to security in the finest spirt of due diligence. It should be ok for people to open

Somewhat off topic but this is actually pretty positive proactive approach to security in the finest spirt of due diligence. It should be ok for people to open tickets to look into curious things no matter how trivial. Tickets don’t have to become incidents. This is what triage is for. The real security incident here is how did the intercept learn of that ticket as that should really be classified.

WalterSear 6y ago
Is it, though? It strikes me as a sarcastic joke by burnt out security staff. Which would explain why we are hearing about it.
- Twirrim 6y ago
  No, it's very much in line with the way Amazon Security staff operated when I worked there. They very much favour proactive reports, and heavily emphasised that they'd rather have a ticket and resolve it as nothing, than not be ticketed at all because you're not sure. Unusual behaviour on a twitter account are most definitely things they'd expect to have reported to them for evaluation, or expect to report themselves if they saw it.
  - WalterSear 6y ago
    Everyone, everywhere, favours proactive security reports, or should do so. This however, makes it possible to make security reports for political effect - after all, if your guidelines are to report anything suspicious, nobody can fault you for doing just that. Is it also standard policy at Amazon to leak security reports to the media, or discuss them with journalists after the fact? We both know that's not the case.
    - deleted 6y ago
      [deleted]
- slickrick216 6y ago
  This is why I said somewhat off topic as it could be like you said or it could a valid concern. I can’t really tell the intent. Irregardless I think it’s a good call to open a ticket. The amount of times I’ve seen something come from an innocuous user report is frightening. Actually rereading it again I would say the source is the person that opened the ticket and not a member of the security team.
  - WalterSear 6y ago
    Yes, I would argue that this supports my thesis - that the ticket was, at least partially created for humorous effect. If they were taking the matter completely seriously, I would not expect them to consider publicizing it, or discussing the ticket publicly after the fact.
SheinhardtWigCo 6y ago
I find it surprising that the Intercept would be so cavalier about the source material, given that it is likely to have a highly restricted distribution list inside Amazon. Reminds me of this: https://www.nytimes.com/2020/09/13/business/media/the-intercept-source-reality-winner.html https://www.nytimes.com/2020/09/13/business/media/the-interc... > The Intercept scrambled to publish a story on the report, ignoring the most basic security precautions. The lead reporter on the story sent a copy of the document, which contained a crease showing it had been printed out, to the N.S.A. media affairs office, all but identifying Ms. Winner as the leaker.
- ehaughee 6y ago
  This ticket wasn't an encrypted ticket (and thus was not locked down). I'm looking at it right now and I have nothing to do with security nor PR. I don't find this surprising as it contains no proprietary, classified, or customer information.
  - ummonk 6y ago
    There is potentially traceable information there including laptop browser extensions as well as phone camera specs. I'm not sure how doxxable it is but if the Intercept were exercising appropriate caution they wouldn't have published the photo.
    - ehaughee 6y ago
      Sorry, I wasn't trying to dispute your statement on the Intercept's actions. I was just pointing out that the ticket wasn't any more secret or locked down than any normal ticket and thus a large swath of the company had access (although the ticket has since been made private), not a highly restricted distribution list.
whoknew1122 6y ago
At Amazon you're encouraged (and expected) to escalate early and escalate often. Amazon security did its job very well. >"The real security incident here is how did the intercept learn of that ticket as that should really be classified." Looks like someone from the security or PR departments took a picture of the ticket with their cellphone and sent them to the reporter. Security tickets are immediately encrypted and locked down. Only a few members have access typically: The person who opened the ticket, anyone with a need-to-know, and people on the IR team. Even director-level employees need to be manually added to security-related tickets to have view permissions.
- napoleond 6y ago
  > Looks like someone from the security or PR departments took a picture of the ticket with their cellphone and sent them to the reporter. Out of those two groups, Occam's razor implicates the one with a vested interest in currying favor with reporters.
  - JeremyBanks 6y ago
    This is a bad take.
    - colineartheta 6y ago
      Based on the argument given, looks like a fair take to me.
- deleted 6y ago
  [deleted]
- throwawaysea 6y ago
  Someone else in this discussion says this ticket was not locked down (https://news.ycombinator.com/item?id=26626369 https://news.ycombinator.com/item?id=26626369). How do you know that someone from the security or PR department took a picture? It seems much more likely this is typical left leaning employee activism that is prevalent at tech companies.
danpalmer 6y ago
This is a great point. Normalising good security behaviours is hard to do, but important. An old workplace had a great culture around checking ID of anyone you didn't recognise (necessary as they handled a lot of sensitive material), and at my current workplace we regularly run phishing simulations and encourage people to share them in Slack to keep it front of mind (as it's one of the biggest risks we've identified).

WalterSear 6y ago

Is it, though? It strikes me as a sarcastic joke by burnt out security staff. Which would explain why we are hearing about it.

Twirrim 6y ago
No, it's very much in line with the way Amazon Security staff operated when I worked there. They very much favour proactive reports, and heavily emphasised that they'd rather have a ticket and resolve it as nothing, than not be ticketed at all because you're not sure. Unusual behaviour on a twitter account are most definitely things they'd expect to have reported to them for evaluation, or expect to report themselves if they saw it.
- WalterSear 6y ago
  Everyone, everywhere, favours proactive security reports, or should do so. This however, makes it possible to make security reports for political effect - after all, if your guidelines are to report anything suspicious, nobody can fault you for doing just that. Is it also standard policy at Amazon to leak security reports to the media, or discuss them with journalists after the fact? We both know that's not the case.
  - deleted 6y ago
    [deleted]
slickrick216 6y ago
This is why I said somewhat off topic as it could be like you said or it could a valid concern. I can’t really tell the intent. Irregardless I think it’s a good call to open a ticket. The amount of times I’ve seen something come from an innocuous user report is frightening. Actually rereading it again I would say the source is the person that opened the ticket and not a member of the security team.
- WalterSear 6y ago
  Yes, I would argue that this supports my thesis - that the ticket was, at least partially created for humorous effect. If they were taking the matter completely seriously, I would not expect them to consider publicizing it, or discussing the ticket publicly after the fact.

SheinhardtWigCo 6y ago

I find it surprising that the Intercept would be so cavalier about the source material, given that it is likely to have a highly restricted distribution list inside Amazon. Reminds me of this: https://www.nytimes.com/2020/09/13/business/media/the-intercept-source-reality-winner.html https://www.nytimes.com/2020/09/13/business/media/the-interc... > The Intercept scrambled to publish a story on the report, ignoring the most basic security precautions. The lead reporter on the story sent a copy of the document, which contained a crease showing it had been printed out, to the N.S.A. media affairs office, all but identifying Ms. Winner as the leaker.

ehaughee 6y ago
This ticket wasn't an encrypted ticket (and thus was not locked down). I'm looking at it right now and I have nothing to do with security nor PR. I don't find this surprising as it contains no proprietary, classified, or customer information.
- ummonk 6y ago
  There is potentially traceable information there including laptop browser extensions as well as phone camera specs. I'm not sure how doxxable it is but if the Intercept were exercising appropriate caution they wouldn't have published the photo.
  - ehaughee 6y ago
    Sorry, I wasn't trying to dispute your statement on the Intercept's actions. I was just pointing out that the ticket wasn't any more secret or locked down than any normal ticket and thus a large swath of the company had access (although the ticket has since been made private), not a highly restricted distribution list.

whoknew1122 6y ago

At Amazon you're encouraged (and expected) to escalate early and escalate often. Amazon security did its job very well. >"The real security incident here is how did the intercept learn of that ticket as that should really be classified." Looks like someone from the security or PR departments took a picture of the ticket with their cellphone and sent them to the reporter. Security tickets are immediately encrypted and locked down. Only a few members have access typically: The person who opened the ticket, anyone with a need-to-know, and people on the IR team. Even director-level employees need to be manually added to security-related tickets to have view permissions.

napoleond 6y ago
> Looks like someone from the security or PR departments took a picture of the ticket with their cellphone and sent them to the reporter. Out of those two groups, Occam's razor implicates the one with a vested interest in currying favor with reporters.
- JeremyBanks 6y ago
  This is a bad take.
  - colineartheta 6y ago
    Based on the argument given, looks like a fair take to me.
deleted 6y ago
[deleted]
throwawaysea 6y ago
Someone else in this discussion says this ticket was not locked down (https://news.ycombinator.com/item?id=26626369 https://news.ycombinator.com/item?id=26626369). How do you know that someone from the security or PR department took a picture? It seems much more likely this is typical left leaning employee activism that is prevalent at tech companies.

danpalmer 6y ago

This is a great point. Normalising good security behaviours is hard to do, but important. An old workplace had a great culture around checking ID of anyone you didn't recognise (necessary as they handled a lot of sensitive material), and at my current workplace we regularly run phishing simulations and encourage people to share them in Slack to keep it front of mind (as it's one of the biggest risks we've identified).