4 ms·
At Amazon you're encouraged (and expected) to escalate early and escalate often. Amazon security did its job very well. >"The real security incident here is ho
by whoknew1122 6y ago
At Amazon you're encouraged (and expected) to escalate early and escalate often. Amazon security did its job very well.
>"The real security incident here is how did the intercept learn of that ticket as that should really be classified."
Looks like someone from the security or PR departments took a picture of the ticket with their cellphone and sent them to the reporter.
Security tickets are immediately encrypted and locked down. Only a few members have access typically: The person who opened the ticket, anyone with a need-to-know, and people on the IR team. Even director-level employees need to be manually added to security-related tickets to have view permissions.
- napoleond 6y ago> Looks like someone from the security or PR departments took a picture of the ticket with their cellphone and sent them to the reporter. Out of those two groups, Occam's razor implicates the one with a vested interest in currying favor with reporters.
- JeremyBanks 6y agoThis is a bad take.
- colineartheta 6y agoBased on the argument given, looks like a fair take to me.
- deleted 6y ago[deleted]
- throwawaysea 6y agoSomeone else in this discussion says this ticket was not locked down (https://news.ycombinator.com/item?id=26626369 https://news.ycombinator.com/item?id=26626369). How do you know that someone from the security or PR department took a picture? It seems much more likely this is typical left leaning employee activism that is prevalent at tech companies.
- whoknew1122 6y ago1.) I never bothered to look up the ticket on the Amazon internal ticketing system. Given what the reporter alleged (i.e. that it was handled by someone from Amazon Security), I presumed it would take the standard security-related ticket handling procedures. I obviously wouldn't look in internal ticketing systems and THEN post to my findings to a public forum like HN. For obvious reasons. 2.) > "It seems much more likely this is typical left leaning employee activism that is prevalent at tech companies." If standard security ticket procedures were followed, it would have been locked down to the security team and the impacted team (i.e. PR/social media). The comment that it 'seems much more likely that this is typical left leaning employee activism' implies that there aren't left-leaning or activists within the security or PR departments. Which if you believe that... lul...
- deeblering4 6y ago> At Amazon you're encouraged (and expected) to escalate early and escalate often One of the many reasons I’d never want to work there
- b0afc375b5 6y agoMaybe I'm missing something, but why is escalating early and often a bad idea? Isn't that just part of being a responsible adult?
- junon 6y agoHuh? This is a good thing. This is how security teams should be operating...
- wkavey 6y agoHahaha I'm sure most companies wouldn't want you either. If my code is broken I want to know ASAP.
- whoknew1122 6y agoAt least takes like the theirs is why people in cybersecurity can easily find jobs.