7 ms·

I'm curious for folks who like solutions like this, have you ever had a vulnerability in production? I would be shocked if most software engineers haven't had a

by notJim 5y ago

I'm curious for folks who like solutions like this, have you ever had a vulnerability in production? I would be shocked if most software engineers haven't had at least one outdated package, or one line of poorly-escaped javascript or similar at some point. It seems like luck (and maybe being a poor target) that these things are usually found before they are exploited. Should the companies we all work for cease to exist? I agree broadly with regulations designed to raise the cost of security flaws and so on, but I feel like there's this expectation that if we make the punishment extreme enough, people will begin writing perfect software and operating perfect servers, and I just don't buy it. It seems sort of like saying if someone causes a production issue or accidentally leaks a database, they should be summarily fired. More likely it was a mistake, and we should understand why it happened so we can prevent it in the future.

amelius 5y ago
Being a large company, they should at least demonstrate that they took appropriate measures. E.g. show the reports written by the pen-testers they hired.
- amelius 5y ago
  I'm being downvoted without argumentation, but how will security ever be taken seriously if these measures don't become the norm?
koolba 5y ago
If you’re billion dollar company’s application architecture is such that any one compromised system leaks the entirety of your customer data then you’re definitely doing it wrong. It’s not just a matter of one compromised package being able to wreak havoc, it’s the scale and blast radius of the havoc.
- oyashirochama 5y ago
  Also lack of isolation of critical systems, the biggest fault honestly. Basically isolate all PII and other systems from each other.
- madrox 5y ago
  Any time you get compromised, you're doing it wrong. What's discussed here is what should the consequences be for doing it wrong. In legal terms, the question is whether this was ordinary negligence or gross negligence. Gross negligence usually comes with pretty stiff penalties. What's discussed in this thread is whether the larger a company is, the more likely it's gross negligence. The irony to me is that every large company I've worked with takes security very seriously. The only gross negligence I've seen has come from startups that willfully disregard security practices in the name of moving fast.
  - awsthro00945 5y ago
    >The irony to me is that every large company I've worked with takes security very seriously. The only gross negligence I've seen has come from startups that willfully disregard security practices in the name of moving fast. Couldn't agree more. I've done security consulting for many companies of varying sizes. The large ones almost universally have massive security budgets, constant pentesting, and security audits/processes out the ass. They still get breached because security is fucking hard, no matter how much money you throw at it. I don't buy in to the whole "if only those evil MBA manager types would allocate more budget to security and take security more seriously, they wouldn't get hacked". Every company I've worked at is scared shitless of being hacked, and have enormous security budgets. The management chain usually takes it very seriously. IME, a huge part of the problem actually ends up being the individual development teams who skip things like encryption because they think it's too onerous or they just think it's frivolous. I cannot even begin to tell you the amount of time I have had to spend with developers arguing with them that they do need to do things like encrypt PII or enable HTTPS. "But it's only a small database of SSNs, do we really have to encrypt it? We would rather spend the developer time building something else rather than implementing encryption!" they say, and then spend hours/days arguing about it rather than just doing it.
    - madrox 5y ago
      > I don't buy in to the whole "if only those evil MBA manager types would allocate more budget to security and take security more seriously, they wouldn't get hacked". This is a corollary to "nine women can't make a baby in a month."
- Sebb767 5y ago
  If you're a billion dollar company, your attack surface is insanely large. Just as per usual work, thousands of people need to have access to the data, hundreds of software developers write code processing it and it's distributed over a lot of places. Plus, if you lock it down too much, things like simple customer service become either insanely expensive or outright impossible (imagine you'd need to iterate all your account details and show your passport just to answer a question about your account in a store!). That's not to say that breaches like this should just get punished by a slap on the wrist; this clearly must not happen. But especially when the company is so large you simply have an insanely large attack surface that comes with it. And it only takes one weak spot on there for an attacker to get in. People have casually carried out all data from Facebook, LinkedIn and even the NSA (multiple times!) - security at that scale simply is hard.
  - YeBanKo 5y ago
    > things like simple customer service become either insanely expensive or outright impossible This is true. It is hard to design a CS backend that user user friendly and privacy cognizant at the same time. However, the other issue is sticky habit of the companies to grab on to as much data as possible and keep it just in case. For example, this breach had SSN next to user's phone number, name and address. Why does it need to store SSN at the first place after initial verification? It is not necessary for most of it's operation. The only reason I can think of is if they want to report defaulted payments to credits bureau. Although, storing SSN can be avoided in a similar way, how payment APIs allow you to minimize handling of credit card number, of course you need support for this from credits bureau. If they aren't cooperative, you can still design the system in compartmentalized way, that simply does not keep an association between SSN and other user info in one place, because SSN is used in very narrow scenarios. There is not enough pressure on the companies right now to do that.
koheripbal 5y ago
It's just victim blaming and anti-corporation rhetoric. No one over 30 takes this position seriously.
- vlovich123 5y ago
  I don't know. I'm over 30 & I think the punishments aren't severe enough for repeat offenders (maybe T-Mobile falls here?) or in the face of egregious violations of best practices & incompetence (Equifax). I think firing the board of directors & instantly selling off the shares of the majority stock holders on the open market might be better measures, but it requires the government bringing lawsuits & that's not popular in the US anymore.
- gibba999 5y ago
  I'm over 30 too, and I believe in not allowing corporations to externalize costs onto customers. If my data is compromised, that should be very, very expensive for the corporation. When I was young, I wasn't a fan of this sort of policy, since I looked at things less holistically, and on shorter timeframes. Holistically, higher damages aren't anticorporation, but just shift the ecosystem. Over time, companies who treat data securely will have a market advantage. Different, more secure programming practice will evolve, and companies will innovate and compete in security. My thinking changed around the time GDPR passed. Before, I thought policies like that were anti-corporate. After, I saw how they changed market forces, but economies did just fine or better. Externalizing costs isn't good for economies.
  - Sebb767 5y ago
    > I'm over 30 too, and I believe in not allowing corporations to externalize costs onto customers. They shouldn't be externalized onto the victims. The cost will, by principle, always be externalized to their customers, since that is were the money has to come from.
    - gibba999 5y ago
      You're assuming perfect market transparency. That's a false assumption. Company A has good security, which adds $5 in your costs. Company B has poor security, which doesn't, which will lead to $500 down-the-line from a security breach and identity theft. It charges $2.50 less and otherwise has an identical product. You have no way to know that. You will go with company B, and you will split the $5 gain, where you save $2.50 and they take $2.50 more in profit. Company B externalizes costs onto the customer. Company A's customers have higher initial costs, but they wouldn't be defined as 'externalized.'
lmm 5y ago
I could follow a far more secure development process than I currently do, but I'd get fired for not producing features quickly enough. Maybe it's impossibly hard to write perfect software, but we'd only find that out if we started actually trying to.

by notJim 5y ago

amelius 5y ago

Being a large company, they should at least demonstrate that they took appropriate measures. E.g. show the reports written by the pen-testers they hired.

amelius 5y ago
I'm being downvoted without argumentation, but how will security ever be taken seriously if these measures don't become the norm?

koolba 5y ago

If you’re billion dollar company’s application architecture is such that any one compromised system leaks the entirety of your customer data then you’re definitely doing it wrong. It’s not just a matter of one compromised package being able to wreak havoc, it’s the scale and blast radius of the havoc.

oyashirochama 5y ago
Also lack of isolation of critical systems, the biggest fault honestly. Basically isolate all PII and other systems from each other.
madrox 5y ago
Any time you get compromised, you're doing it wrong. What's discussed here is what should the consequences be for doing it wrong. In legal terms, the question is whether this was ordinary negligence or gross negligence. Gross negligence usually comes with pretty stiff penalties. What's discussed in this thread is whether the larger a company is, the more likely it's gross negligence. The irony to me is that every large company I've worked with takes security very seriously. The only gross negligence I've seen has come from startups that willfully disregard security practices in the name of moving fast.
- awsthro00945 5y ago
  >The irony to me is that every large company I've worked with takes security very seriously. The only gross negligence I've seen has come from startups that willfully disregard security practices in the name of moving fast. Couldn't agree more. I've done security consulting for many companies of varying sizes. The large ones almost universally have massive security budgets, constant pentesting, and security audits/processes out the ass. They still get breached because security is fucking hard, no matter how much money you throw at it. I don't buy in to the whole "if only those evil MBA manager types would allocate more budget to security and take security more seriously, they wouldn't get hacked". Every company I've worked at is scared shitless of being hacked, and have enormous security budgets. The management chain usually takes it very seriously. IME, a huge part of the problem actually ends up being the individual development teams who skip things like encryption because they think it's too onerous or they just think it's frivolous. I cannot even begin to tell you the amount of time I have had to spend with developers arguing with them that they do need to do things like encrypt PII or enable HTTPS. "But it's only a small database of SSNs, do we really have to encrypt it? We would rather spend the developer time building something else rather than implementing encryption!" they say, and then spend hours/days arguing about it rather than just doing it.
  - madrox 5y ago
    > I don't buy in to the whole "if only those evil MBA manager types would allocate more budget to security and take security more seriously, they wouldn't get hacked". This is a corollary to "nine women can't make a baby in a month."
Sebb767 5y ago
If you're a billion dollar company, your attack surface is insanely large. Just as per usual work, thousands of people need to have access to the data, hundreds of software developers write code processing it and it's distributed over a lot of places. Plus, if you lock it down too much, things like simple customer service become either insanely expensive or outright impossible (imagine you'd need to iterate all your account details and show your passport just to answer a question about your account in a store!). That's not to say that breaches like this should just get punished by a slap on the wrist; this clearly must not happen. But especially when the company is so large you simply have an insanely large attack surface that comes with it. And it only takes one weak spot on there for an attacker to get in. People have casually carried out all data from Facebook, LinkedIn and even the NSA (multiple times!) - security at that scale simply is hard.
- YeBanKo 5y ago
  > things like simple customer service become either insanely expensive or outright impossible This is true. It is hard to design a CS backend that user user friendly and privacy cognizant at the same time. However, the other issue is sticky habit of the companies to grab on to as much data as possible and keep it just in case. For example, this breach had SSN next to user's phone number, name and address. Why does it need to store SSN at the first place after initial verification? It is not necessary for most of it's operation. The only reason I can think of is if they want to report defaulted payments to credits bureau. Although, storing SSN can be avoided in a similar way, how payment APIs allow you to minimize handling of credit card number, of course you need support for this from credits bureau. If they aren't cooperative, you can still design the system in compartmentalized way, that simply does not keep an association between SSN and other user info in one place, because SSN is used in very narrow scenarios. There is not enough pressure on the companies right now to do that.

koheripbal 5y ago

It's just victim blaming and anti-corporation rhetoric. No one over 30 takes this position seriously.

vlovich123 5y ago
I don't know. I'm over 30 & I think the punishments aren't severe enough for repeat offenders (maybe T-Mobile falls here?) or in the face of egregious violations of best practices & incompetence (Equifax). I think firing the board of directors & instantly selling off the shares of the majority stock holders on the open market might be better measures, but it requires the government bringing lawsuits & that's not popular in the US anymore.
gibba999 5y ago
I'm over 30 too, and I believe in not allowing corporations to externalize costs onto customers. If my data is compromised, that should be very, very expensive for the corporation. When I was young, I wasn't a fan of this sort of policy, since I looked at things less holistically, and on shorter timeframes. Holistically, higher damages aren't anticorporation, but just shift the ecosystem. Over time, companies who treat data securely will have a market advantage. Different, more secure programming practice will evolve, and companies will innovate and compete in security. My thinking changed around the time GDPR passed. Before, I thought policies like that were anti-corporate. After, I saw how they changed market forces, but economies did just fine or better. Externalizing costs isn't good for economies.
- Sebb767 5y ago
  > I'm over 30 too, and I believe in not allowing corporations to externalize costs onto customers. They shouldn't be externalized onto the victims. The cost will, by principle, always be externalized to their customers, since that is were the money has to come from.
  - gibba999 5y ago
    You're assuming perfect market transparency. That's a false assumption. Company A has good security, which adds $5 in your costs. Company B has poor security, which doesn't, which will lead to $500 down-the-line from a security breach and identity theft. It charges $2.50 less and otherwise has an identical product. You have no way to know that. You will go with company B, and you will split the $5 gain, where you save $2.50 and they take $2.50 more in profit. Company B externalizes costs onto the customer. Company A's customers have higher initial costs, but they wouldn't be defined as 'externalized.'

lmm 5y ago

I could follow a far more secure development process than I currently do, but I'd get fired for not producing features quickly enough. Maybe it's impossibly hard to write perfect software, but we'd only find that out if we started actually trying to.