15 ms·

Wide-ranging SolarWinds probe sparks fear in Corporate America

313 points by kordlessagain 5y ago

mikewarot 5y ago
The age old advice is "don't talk to the police"... I imagine that goes wayyyyy more for talking to the SEC. Of course they're fearful.
- ndespres 5y ago
  I have noticed "don't talk to the police" being repeated often around here lately, with links to the youtube video. While it is probably good advice for your general day-to-day encounters with police, I don't think it is great advice for a executives of the corporation dealing with the SEC.
  - maeln 5y ago
    I think the whole sentence should be "don't talk to the police without a lawyer / let the lawyer speak for you". And in the case of an executives talking to the SEC you should absolutely have a lawyer, or multiple, with you.
  - jdavis703 5y ago
    I was audited by the “tax police” at the IRS. We had a constructive conversation, I fixed the problem, paid some more taxes and was done. I don’t think this advice applies to all government investigators.
    - luckylion 5y ago
      You can always be lucky. I was audited a few years ago, they didn't find any issues. So, just for fun, they added a special audit 3 months later. Needless to say they didn't find anything that time either. Don't talk to the police or the IRS. They are never aligned with your interests, and whether you get a reasonable person or someone who just loves to ruin your day is random.
      - only_as_i_fall 5y ago
        I've never been audited, but isn't it more a case of "you must talk to the IRS or they'll simply collect what they think you owe and leave you no recourse"?
        luckylion 5y ago
        Sure, you have to provide the stuff they request, just like you have to comply with police officers in the moment, but you don't need to (and should not) talk "help" them or give them any information beyond what you're required by law, which is often your name and not much more. If our local IRS equivalent contacted me "to clear something up", I'd defer them to my tax consultant in all cases. Assuming good faith with state employees is often a costly mistake.
      - jdavis703 5y ago
        Let me precise, I was audited because I forgot a 1099 form. It was a stupid mistake on my side. If you’re being audited just so they can root around and find a problems, then yeah be careful.
    - toss1 5y ago
      Yes, multiple people that I've known have been audited by the IRS. All were small business owners who did their own taxes (vs having them done & submitted by a CPA). At the end of all the audits, the IRS ended up writing a check to the businesses. (If you can find more overlooked deductions the exceed the overlooked taxable items, they must make the adjustments in your favor.) One good friend got audited five years in a row; maybe the local bureau chief was just sure he was up to something. The last time they were writing a check to him, it was going to be for less than $2, and the agent asked if they really wanted it — "Of course I damn well want you to write that check!". I've had a career mostly in small businesses, and always had a CPA do it with never an audit. I strongly suspect that it not only likely gets me more proper deductions that I'd miss, but also gets a lot of points in avoiding an audit, since the CPA is also putting their license on the line by signing it. I'd recommend the practice, just find a good one who charges flat rate (they do exist, just takes some looking).
  - Ms-J 5y ago
    Actually, not talking to or interacting with the police sounds like the most rational advice for American's right now.
  - Accujack 5y ago
    You'd be surprised. At my employer, I'm told before every meeting with internal and external auditors to not offer unrelated information to them. Basically, give them only what they ask for and exactly what they ask for. If no one sees something, it doesn't exist, right?
jeffwask 5y ago
Good. Security will only be a priority when it's more expensive than profit.
- A4ET8a8uTh0 5y ago
  I will only add: About god damn fucking time.
  - deleted 5y ago
    [deleted]
- 1970-01-01 5y ago
  That's part of the definition of good security engineering. Protect stuff up to its value, and never spend more money than what is needed to rebuild it from scratch.
  - daveslash 5y ago
    Yep. This. Couldn't agree more. I went to a BSides talk years ago titled "Does DoD Level Security Apply to the Real World?" ~ In summary, Yes. The premise of the talk, as I understood it, was that too many small operations or "mom and pop" shops think that they do not need "Department of Defense" level security, because they're a small general store, not Fort Knox. That's a misconception. "DoD Level Security" doesn't mean that you protect your place like the NOC list in Mission Impossible; it means that you are proactive in thinking about your thread model and assessing the value of your assets. If, after proactively thinking it through, you're still comfortable with just a cheap pad lock and no alarm system, then you've applied "DoD Level Security" (or something like it).
    - oars 5y ago
      Link to video: https://m.youtube.com/watch?v=Dk8wFplHqro https://m.youtube.com/watch?v=Dk8wFplHqro
  - mupuff1234 5y ago
datameta 5y ago
Zero accountability, complete lack of responsibility, and a total absence of sufficient security in far too many instances. Something like this has been long long overdue.
- SV_BubbleTime 5y ago
  Yes. But - I’m skeptical that a probe will have any more teeth than the censorship testimony fist shaking we’ve seen at Zuckerberg and Dorsey. Even if there is, the solution needs to be punitive. That if you ship shitty software and didn’t follow good practices that you’ll be investigated and fined. New frameworks for what constitutes software negligence. The last thing I would want to see is software regulation, oversight of development, Government access. For about a dozen reasons each.
  - datameta 5y ago
    The implementation of anything in the last paragraph would be a shit snowball of the finest degree.
    - ClumsyPilot 5y ago
      Yeah, god forbid if the public has access to source code of critical systems that the country relies upon to run critical infrastructure like oil pipelines. We might loose any respect for people in charge whatsoever.
      - SV_BubbleTime 5y ago
        Just like all the transparency from all the other gov agencies right? And I think the discussion is about private businesses not some forced open source ideal you seem to have conjured up.
        ClumsyPilot 5y ago
        It is your private business freemarket ideal when half the country comes to a standstill because the oil pipeline runs on windows XP or some shit?
csbartus 5y ago
It’s time to fix software security. And it’s gonna be hard. First, there is no unbreakable software. Second, software is written by average people vs above-the-average people who are hacking it. Mission impossible.
- only_as_i_fall 5y ago
  Is there evidence that the average hacker is smarter than the average developer? I would expect the opposite to be true because legitimate work seems more profitable/stable, but also I'd imagine the difference is t that high either way
  - dennisnedry 5y ago
    Of course not, this is just the parent poster's opinion. The truth of the matter is that there exceptional individuals who decide to get into software development and software security. The problem with software is that often companies don't invest into securing their software, and that has to be a priority. Perhaps having the SEC force fines for not securing mission critical software is the first step?
  - datameta 5y ago
    I think the incentives are lopsided. The developer does not personally bear the blow of their company's data breach (unless they're dedicated cybersec personnel) whereas the hacker reaps all the reward of getting access.
  - deleted 5y ago
    [deleted]
  - IncRnd 5y ago
    The parent never used the word "smarter". By definition, the average developer is developing applications, but the non-average developer is doing something else, possibly hacking. Hacking is not the average activity (the way that word is used today). With regards to skill sets, I have repeatedly found that people who engage in hacking range from skill sets of "knowing how to use a hacking kit" to "uber developer with security knowledge". There is a wide range of skills and knowledge. However, it is practically an entry requirement for someone in the security space to view software differently than most programmers. That is defined as non-average.
TechBro8615 5y ago
Why the SEC? I would expect this to be more the domain of FBI or NSA or any of the more “cyber”-related three letter manifestations of the executive branch. Either way, I’m glad government agents are going door to door to check on privately owned servers. Maybe they should check everyone’s vaccination status while they’re at it.
- dennisnedry 5y ago
  Because the SEC regulates publicly traded companies.
- IncRnd 5y ago
  "The U.S. Securities and Exchange Commission is a large independent agency of the United States federal government, created in the aftermath of the Wall Street Crash of 1929. The primary purpose of the SEC is to enforce the law against market manipulation." "In addition to the Securities Exchange Act of 1934, which created it, the SEC enforces the Securities Act of 1933, the Trust Indenture Act of 1939, the Investment Company Act of 1940, the Investment Advisers Act of 1940, the Sarbanes–Oxley Act of 2002, and other statutes. The SEC was created by Section 4 of the Securities Exchange Act of 1934 (now codified as 15 U.S.C. § 78d and commonly referred to as the Exchange Act or the 1934 Act)." [1] [1] https://en.wikipedia.org/wiki/U.S._Securities_and_Exchange_Commission https://en.wikipedia.org/wiki/U.S._Securities_and_Exchange_C...
- csours 5y ago
  "Everything is Security Fraud" - Matt Levine (Money Stuff guy)
- PeterisP 5y ago
  Because apparently SEC had years ago issued an order that breaches must be disclosed if they may have a material impact on shareholders (e.g. a potential large lawsuit from customers some years afterwards when the full extent becomes known), and it's the job of SEC to ensure that company executives don't hide company problems from the shareholders. In essence, if you want to keep your dirty laundry private, then you're not allowed to take money from the public stock market, as investors (i.e. everyone if you want to be publicly traded) deserve to know about any major issues with your private servers. SEC doesn't care about how poor your security is as long as the company is open about it, but it absolutely cares if company lies about their (lack of) exposure to its owners.
h2odragon 5y ago
At some point, "corporate america" decided that willful ignorance was better than making an effort, possibly failing, and possibly being held liable for that failure. Its annoying that there's law for people, then there's laws that apply to some corporations, but not always and not all of them. "Maintaining an attractive nuisance" is what they tell people with unfenced junkyards, right? Why couldn't that apply to some of these folks aggregating data about our kinks "unwittingly" displaying the results to the world.
- SavantIdiot 5y ago
  More like they wanted to avoid mob panic. If the corporation was hacked and kept it on the DL, but boosted security posture in response, is that a bad thing? If they were hacked and did nothing, well, screw them. Perhaps the SEC should couch the expectations with a bit of reassurance.
  - toomuchtodo 5y ago
    > If the corporation was hacked and kept it on the DL, but boosted security posture in response, is that a bad thing? If it's a public company, it's securities fraud. IMHO, securities law is the most effective tool at the moment in encouraging improved security engineering, best practices, and posture. https://www.sec.gov/news/press-release/2021-154 https://www.sec.gov/news/press-release/2021-154 ""As the order finds, Pearson opted not to disclose this breach to investors until it was contacted by the media, and even then Pearson understated the nature and scope of the incident, and overstated the company's data protections," said Kristina Littman, Chief of the SEC Enforcement Division's Cyber Unit. "As public companies face the growing threat of cyber intrusions, they must provide accurate information to investors about material cyber incidents." The SEC's order found that Pearson violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 and Section 13(a) of the Exchange Act of 1934 and Rules 12b-20, 13a-15(a), and 13a-16 thereunder. Without admitting or denying the SEC's findings, Pearson agreed to cease and desist from committing violations of these provisions and to pay a $1 million civil penalty."
    - 5y ago
rfd4sgmk8u 5y ago
People are worried about the wrong stuff. SolarWinds was bad but it was likely intel operation. They wanted access to networks for intelligence purposes. They jacked it so they could access assets behind corp firewalls. Spys will always try to spy. IMHO the Kaseya hack was far worse, maybe worse than WannaCry but with better outcomes. This was a criminal operation, provided by criminal software suppliers that really was only resolved when the keys were leaked on a forum. The rumor is that local intelligence forced the disclosure of the keys (eg: guns to heads), because this is pretty much the destroy the world scenario that is unstoppable. It is easy easy for attackers to cause billions of dollars of damage in a day. Its not getting better. It can't. Our systems are designed for large scope of trust with massive surface areas. Security is a game where the defenders cannot mess up once. Its hopelessly asymmetric and can never be better.
- ep103 5y ago
  we can start by repealing laws that give corporate entities immunity when data is leaked. Make them liable for lawsuits with set minimum damage amounts for exposed data, and one would be able to watch the money flow into better tech security on a society-wide scale.
  - ClumsyPilot 5y ago
    We can also add a prohibition on three-letter agencies installing purposeful backdoors which are later exploited by criminals. Maybe it's time they actually were helping regular citizen protect themselves and their privacy, instead of playing chicken with their counterparts abroad.
    - acdha 5y ago
      I support that but … how often has that happened? That Juniper incident didn’t seem to be widespread and it certainly doesn’t appear that a notable percentage of breaches are due that kind of thing.
      - fragmede 5y ago
dukeofdoom 5y ago
Corporate America should pay more attention. Growing revolt among the proletariat over lockdown and arbitrary technocracy rules. Vaccine mandates will push this even more. Its crazy to think the White House got stormed less than a year ago. Who knows how many dirty secrets The SolarWinds hack has soaked up, and what will be revealed down the line.
- lovich 5y ago
  As a point of pedantry, the White House did not get stormed, the Capitol building did.
  - dukeofdoom 5y ago
    You're right. My mistake. However it was a little a year ago (June) that BLM protestors breached the fence surrounding the White House, and Trump went into a bunker. If the media reports were correct.
    - kordlessagain 5y ago
      It’s always possible to mention things that have little to do with the actual conversation and yet still have an amount of semantic context with things that are statistically insignificant.
motohagiography 5y ago
Can't help but ask, but as a security pro, what would the consequences be if we just let it burn?
kordlessagain 5y ago
This is what happens when you delete Hoover Beaver.
_wldu 5y ago
Good, some of these companies are run by socially connected technical morons who hire a bunch of their college buddies as 'leaders'. These people need to be exposed. Years ago, a guy I know was asked by management to spec out an email system that had no limits on the size of file attachments. He asked why and was told that 'leadership will have no limits on their authority... none whatsoever'. When he produced the quote, leadership was in shock. The price was enormous. They told him they could not afford to spend that much money on a mail system, and he said, "Well, I guess there will have to be limits then."
- throwdecro 5y ago
  > 'leadership will have no limits on their authority... none whatsoever' For some reason I envy whoever got to hear that sentence in real life. It makes it perfectly clear that you're dealing with assclowns.
  - Ms-J 5y ago
    I have worked for a boss like that but it really wasn't bad. He knew what he wanted, and left us alone to do our jobs. No micromanagement from middle managers, was very nice.
- unemphysbro 5y ago
  ah, I didn't realize email attachment size was holding me back.
- ronsor 5y ago
  > leadership will have no limits on their authority... none whatsoever It will be unfortunate for them to hear that disk space places limits on their "authority."
- deleted 5y ago
  [deleted]
jszymborski 5y ago
I'm wondering if anyone here on HN actually knows if any of this has teeth and if corpos are legitimately worried or if it's more of a feint. I'm generally skeptical of SEC enforcement.
AlbertCory 5y ago
I've read all the comments, and as usual, no one's asked "what do other industries do?" Money-handling, for example (banks, payment systems). If ever there was a Fraud Magnet, that's it. I've heard PayPal described as "a giant fraud-detection system, wrapped around a tiny money-transferring system." And yet, they don't seem to be in the news all the time like "data theft" stories are. Could it be that the legal and regulatory and insurance systems have made it a manageable problem? Someone steals your credit card, your losses are capped. Someone steals your Personally Identifying Information, sorry, pal; change your passwords. So maybe treating PII as the same thing, in every way, as money is the answer.
- acdha 5y ago
  One useful move would be changing laws around identity theft so companies are liable for any costs incurred from their failure to verify identity, or for reporting credit issues from unvalidated activity. Americans worry about things like SSNs getting breached because they don’t want to get someone else’s bill — if companies were required to check photo ID against a real person (not an uploaded photo) that’d be a much harder crime to make financially viable.
  - deleted 5y ago
    [deleted]
  - PeterisP 5y ago
    Indeed, it is ridiculous that "identity theft" places a burden on the person whose identity was used - if someone opens an account in my name and the only "evidence" is having provided something that other people (e.g. my mother or spouse) can know, then in any dispute it should be illegal for that fraud/debt to appear on my credit report. That's the way how most of the world has mostly solved identity theft, however, it's not that easy to implement in USA because there's no system of universal secure IDs in USA (by design) - there's a multitude of ID forms, some of them are not really secure (easy to forge, no verification if it was really issued by the institution who did so, no easy process to quickly verify online if the provided credential has been lost/stolen/revoked, etc), and there's a sufficiently large minority of potential customers who don't have a valid ID. It would be helpful to have laws that clearly assign the credit fraud risk fully onto the defrauded companies instead of the people whose identities were used, as experience shows that this would rapidly result in improvements to fraud elimination (there's all kinds of measures that simply are not taken since they add friction), however, a proper solution does require a decent state-run identity system as the foundation of trust, and USA has made a political decision to not have one.
tisthetruth 5y ago
Some might find this interesting: https://vengrams.blogspot.com/2021/09/security-is-layered-process.html?m=1 https://vengrams.blogspot.com/2021/09/security-is-layered-pr...
nimbius 5y ago
as of April 2021 Solarwinds still shows up in Gartner reports read by managers and 'thought leaders.' until they start losing prestige in the trade rags you can expect them to endure as a corporate standard, best practice, industry standard, and "enterprise grade" solution regardless of what common sense and competent system administrators at your company say.
tisthetruth 5y ago
Does this classify as something one can submit a tip about under the SEC.gov's Whistlerblower program?
leptoniscool 5y ago
For sensitive software like these, we should make them open-source so that more eyeballs are looking at it..
lifeisstillgood 5y ago
- Offer amnesty / limited liability / zero liability for losses following breaches - require full disclosure to national data registrars following breaches from now on. - Make source of income as big a deal as KYC - make KYC a "walk in the branch with some photo id". How many of us really need to borrow thousands without going into a store or bank.
- Ms-J 5y ago
  I'm very confused about your last bullet point. I don't use physical banks for my finances and do all my finances online (like many people). I regularly move thousands of Euros and don't see why I would need a physical bank. That would severely impact a lot of people.
  - lifeisstillgood 5y ago
    KYC - Know your customer. Someone opens a new account prove you know who that person really is. Basically photo id in branch will end "identity theft", and similar beneficiary owner rules more or less ends money laundering fundamentally, we have as much crime as we are willing to let the banks allow.
a-dub 5y ago
if a public company fails at infosec, and financials or other material nonpublic information is stolen and used to trade, then yea, it's securities fraud.
deleted 5y ago
[deleted]

313 points by kordlessagain 5y ago

The age old advice is "don't talk to the police"... I imagine that goes wayyyyy more for talking to the SEC. Of course they're fearful.

ndespres 5y ago
I have noticed "don't talk to the police" being repeated often around here lately, with links to the youtube video. While it is probably good advice for your general day-to-day encounters with police, I don't think it is great advice for a executives of the corporation dealing with the SEC.
- maeln 5y ago
  I think the whole sentence should be "don't talk to the police without a lawyer / let the lawyer speak for you". And in the case of an executives talking to the SEC you should absolutely have a lawyer, or multiple, with you.
- jdavis703 5y ago
  I was audited by the “tax police” at the IRS. We had a constructive conversation, I fixed the problem, paid some more taxes and was done. I don’t think this advice applies to all government investigators.
  - luckylion 5y ago
    You can always be lucky. I was audited a few years ago, they didn't find any issues. So, just for fun, they added a special audit 3 months later. Needless to say they didn't find anything that time either. Don't talk to the police or the IRS. They are never aligned with your interests, and whether you get a reasonable person or someone who just loves to ruin your day is random.
    - only_as_i_fall 5y ago
      I've never been audited, but isn't it more a case of "you must talk to the IRS or they'll simply collect what they think you owe and leave you no recourse"?
      - luckylion 5y ago
        Sure, you have to provide the stuff they request, just like you have to comply with police officers in the moment, but you don't need to (and should not) talk "help" them or give them any information beyond what you're required by law, which is often your name and not much more. If our local IRS equivalent contacted me "to clear something up", I'd defer them to my tax consultant in all cases. Assuming good faith with state employees is often a costly mistake.
    - jdavis703 5y ago
      Let me precise, I was audited because I forgot a 1099 form. It was a stupid mistake on my side. If you’re being audited just so they can root around and find a problems, then yeah be careful.
  - toss1 5y ago
    Yes, multiple people that I've known have been audited by the IRS. All were small business owners who did their own taxes (vs having them done & submitted by a CPA). At the end of all the audits, the IRS ended up writing a check to the businesses. (If you can find more overlooked deductions the exceed the overlooked taxable items, they must make the adjustments in your favor.) One good friend got audited five years in a row; maybe the local bureau chief was just sure he was up to something. The last time they were writing a check to him, it was going to be for less than $2, and the agent asked if they really wanted it — "Of course I damn well want you to write that check!". I've had a career mostly in small businesses, and always had a CPA do it with never an audit. I strongly suspect that it not only likely gets me more proper deductions that I'd miss, but also gets a lot of points in avoiding an audit, since the CPA is also putting their license on the line by signing it. I'd recommend the practice, just find a good one who charges flat rate (they do exist, just takes some looking).
- Ms-J 5y ago
  Actually, not talking to or interacting with the police sounds like the most rational advice for American's right now.
- Accujack 5y ago
  You'd be surprised. At my employer, I'm told before every meeting with internal and external auditors to not offer unrelated information to them. Basically, give them only what they ask for and exactly what they ask for. If no one sees something, it doesn't exist, right?

jeffwask 5y ago

Good. Security will only be a priority when it's more expensive than profit.

A4ET8a8uTh0 5y ago
I will only add: About god damn fucking time.
- deleted 5y ago
  [deleted]
1970-01-01 5y ago
That's part of the definition of good security engineering. Protect stuff up to its value, and never spend more money than what is needed to rebuild it from scratch.
- daveslash 5y ago
  Yep. This. Couldn't agree more. I went to a BSides talk years ago titled "Does DoD Level Security Apply to the Real World?" ~ In summary, Yes. The premise of the talk, as I understood it, was that too many small operations or "mom and pop" shops think that they do not need "Department of Defense" level security, because they're a small general store, not Fort Knox. That's a misconception. "DoD Level Security" doesn't mean that you protect your place like the NOC list in Mission Impossible; it means that you are proactive in thinking about your thread model and assessing the value of your assets. If, after proactively thinking it through, you're still comfortable with just a cheap pad lock and no alarm system, then you've applied "DoD Level Security" (or something like it).
  - oars 5y ago
    Link to video: https://m.youtube.com/watch?v=Dk8wFplHqro https://m.youtube.com/watch?v=Dk8wFplHqro
- mupuff1234 5y ago

datameta 5y ago

Zero accountability, complete lack of responsibility, and a total absence of sufficient security in far too many instances. Something like this has been long long overdue.

SV_BubbleTime 5y ago
Yes. But - I’m skeptical that a probe will have any more teeth than the censorship testimony fist shaking we’ve seen at Zuckerberg and Dorsey. Even if there is, the solution needs to be punitive. That if you ship shitty software and didn’t follow good practices that you’ll be investigated and fined. New frameworks for what constitutes software negligence. The last thing I would want to see is software regulation, oversight of development, Government access. For about a dozen reasons each.
- datameta 5y ago
  The implementation of anything in the last paragraph would be a shit snowball of the finest degree.
  - ClumsyPilot 5y ago
    Yeah, god forbid if the public has access to source code of critical systems that the country relies upon to run critical infrastructure like oil pipelines. We might loose any respect for people in charge whatsoever.
    - SV_BubbleTime 5y ago
      Just like all the transparency from all the other gov agencies right? And I think the discussion is about private businesses not some forced open source ideal you seem to have conjured up.
      - ClumsyPilot 5y ago
        It is your private business freemarket ideal when half the country comes to a standstill because the oil pipeline runs on windows XP or some shit?

csbartus 5y ago

It’s time to fix software security. And it’s gonna be hard. First, there is no unbreakable software. Second, software is written by average people vs above-the-average people who are hacking it. Mission impossible.

only_as_i_fall 5y ago
Is there evidence that the average hacker is smarter than the average developer? I would expect the opposite to be true because legitimate work seems more profitable/stable, but also I'd imagine the difference is t that high either way
- dennisnedry 5y ago
  Of course not, this is just the parent poster's opinion. The truth of the matter is that there exceptional individuals who decide to get into software development and software security. The problem with software is that often companies don't invest into securing their software, and that has to be a priority. Perhaps having the SEC force fines for not securing mission critical software is the first step?
- datameta 5y ago
  I think the incentives are lopsided. The developer does not personally bear the blow of their company's data breach (unless they're dedicated cybersec personnel) whereas the hacker reaps all the reward of getting access.
- deleted 5y ago
  [deleted]
- IncRnd 5y ago
  The parent never used the word "smarter". By definition, the average developer is developing applications, but the non-average developer is doing something else, possibly hacking. Hacking is not the average activity (the way that word is used today). With regards to skill sets, I have repeatedly found that people who engage in hacking range from skill sets of "knowing how to use a hacking kit" to "uber developer with security knowledge". There is a wide range of skills and knowledge. However, it is practically an entry requirement for someone in the security space to view software differently than most programmers. That is defined as non-average.

TechBro8615 5y ago

Why the SEC? I would expect this to be more the domain of FBI or NSA or any of the more “cyber”-related three letter manifestations of the executive branch. Either way, I’m glad government agents are going door to door to check on privately owned servers. Maybe they should check everyone’s vaccination status while they’re at it.

dennisnedry 5y ago
Because the SEC regulates publicly traded companies.
IncRnd 5y ago
"The U.S. Securities and Exchange Commission is a large independent agency of the United States federal government, created in the aftermath of the Wall Street Crash of 1929. The primary purpose of the SEC is to enforce the law against market manipulation." "In addition to the Securities Exchange Act of 1934, which created it, the SEC enforces the Securities Act of 1933, the Trust Indenture Act of 1939, the Investment Company Act of 1940, the Investment Advisers Act of 1940, the Sarbanes–Oxley Act of 2002, and other statutes. The SEC was created by Section 4 of the Securities Exchange Act of 1934 (now codified as 15 U.S.C. § 78d and commonly referred to as the Exchange Act or the 1934 Act)." [1] [1] https://en.wikipedia.org/wiki/U.S._Securities_and_Exchange_Commission https://en.wikipedia.org/wiki/U.S._Securities_and_Exchange_C...
csours 5y ago
"Everything is Security Fraud" - Matt Levine (Money Stuff guy)
PeterisP 5y ago
Because apparently SEC had years ago issued an order that breaches must be disclosed if they may have a material impact on shareholders (e.g. a potential large lawsuit from customers some years afterwards when the full extent becomes known), and it's the job of SEC to ensure that company executives don't hide company problems from the shareholders. In essence, if you want to keep your dirty laundry private, then you're not allowed to take money from the public stock market, as investors (i.e. everyone if you want to be publicly traded) deserve to know about any major issues with your private servers. SEC doesn't care about how poor your security is as long as the company is open about it, but it absolutely cares if company lies about their (lack of) exposure to its owners.

h2odragon 5y ago

At some point, "corporate america" decided that willful ignorance was better than making an effort, possibly failing, and possibly being held liable for that failure. Its annoying that there's law for people, then there's laws that apply to some corporations, but not always and not all of them. "Maintaining an attractive nuisance" is what they tell people with unfenced junkyards, right? Why couldn't that apply to some of these folks aggregating data about our kinks "unwittingly" displaying the results to the world.

SavantIdiot 5y ago
More like they wanted to avoid mob panic. If the corporation was hacked and kept it on the DL, but boosted security posture in response, is that a bad thing? If they were hacked and did nothing, well, screw them. Perhaps the SEC should couch the expectations with a bit of reassurance.
- toomuchtodo 5y ago
  > If the corporation was hacked and kept it on the DL, but boosted security posture in response, is that a bad thing? If it's a public company, it's securities fraud. IMHO, securities law is the most effective tool at the moment in encouraging improved security engineering, best practices, and posture. https://www.sec.gov/news/press-release/2021-154 https://www.sec.gov/news/press-release/2021-154 ""As the order finds, Pearson opted not to disclose this breach to investors until it was contacted by the media, and even then Pearson understated the nature and scope of the incident, and overstated the company's data protections," said Kristina Littman, Chief of the SEC Enforcement Division's Cyber Unit. "As public companies face the growing threat of cyber intrusions, they must provide accurate information to investors about material cyber incidents." The SEC's order found that Pearson violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 and Section 13(a) of the Exchange Act of 1934 and Rules 12b-20, 13a-15(a), and 13a-16 thereunder. Without admitting or denying the SEC's findings, Pearson agreed to cease and desist from committing violations of these provisions and to pay a $1 million civil penalty."
  - 5y ago

rfd4sgmk8u 5y ago

People are worried about the wrong stuff. SolarWinds was bad but it was likely intel operation. They wanted access to networks for intelligence purposes. They jacked it so they could access assets behind corp firewalls. Spys will always try to spy. IMHO the Kaseya hack was far worse, maybe worse than WannaCry but with better outcomes. This was a criminal operation, provided by criminal software suppliers that really was only resolved when the keys were leaked on a forum. The rumor is that local intelligence forced the disclosure of the keys (eg: guns to heads), because this is pretty much the destroy the world scenario that is unstoppable. It is easy easy for attackers to cause billions of dollars of damage in a day. Its not getting better. It can't. Our systems are designed for large scope of trust with massive surface areas. Security is a game where the defenders cannot mess up once. Its hopelessly asymmetric and can never be better.

ep103 5y ago
we can start by repealing laws that give corporate entities immunity when data is leaked. Make them liable for lawsuits with set minimum damage amounts for exposed data, and one would be able to watch the money flow into better tech security on a society-wide scale.
- ClumsyPilot 5y ago
  We can also add a prohibition on three-letter agencies installing purposeful backdoors which are later exploited by criminals. Maybe it's time they actually were helping regular citizen protect themselves and their privacy, instead of playing chicken with their counterparts abroad.
  - acdha 5y ago
    I support that but … how often has that happened? That Juniper incident didn’t seem to be widespread and it certainly doesn’t appear that a notable percentage of breaches are due that kind of thing.
    - fragmede 5y ago

dukeofdoom 5y ago

Corporate America should pay more attention. Growing revolt among the proletariat over lockdown and arbitrary technocracy rules. Vaccine mandates will push this even more. Its crazy to think the White House got stormed less than a year ago. Who knows how many dirty secrets The SolarWinds hack has soaked up, and what will be revealed down the line.

lovich 5y ago
As a point of pedantry, the White House did not get stormed, the Capitol building did.
- dukeofdoom 5y ago
  You're right. My mistake. However it was a little a year ago (June) that BLM protestors breached the fence surrounding the White House, and Trump went into a bunker. If the media reports were correct.
  - kordlessagain 5y ago
    It’s always possible to mention things that have little to do with the actual conversation and yet still have an amount of semantic context with things that are statistically insignificant.

motohagiography 5y ago

Can't help but ask, but as a security pro, what would the consequences be if we just let it burn?

kordlessagain 5y ago

This is what happens when you delete Hoover Beaver.

_wldu 5y ago

Good, some of these companies are run by socially connected technical morons who hire a bunch of their college buddies as 'leaders'. These people need to be exposed. Years ago, a guy I know was asked by management to spec out an email system that had no limits on the size of file attachments. He asked why and was told that 'leadership will have no limits on their authority... none whatsoever'. When he produced the quote, leadership was in shock. The price was enormous. They told him they could not afford to spend that much money on a mail system, and he said, "Well, I guess there will have to be limits then."

throwdecro 5y ago
> 'leadership will have no limits on their authority... none whatsoever' For some reason I envy whoever got to hear that sentence in real life. It makes it perfectly clear that you're dealing with assclowns.
- Ms-J 5y ago
  I have worked for a boss like that but it really wasn't bad. He knew what he wanted, and left us alone to do our jobs. No micromanagement from middle managers, was very nice.
unemphysbro 5y ago
ah, I didn't realize email attachment size was holding me back.
ronsor 5y ago
> leadership will have no limits on their authority... none whatsoever It will be unfortunate for them to hear that disk space places limits on their "authority."
deleted 5y ago
[deleted]

jszymborski 5y ago

I'm wondering if anyone here on HN actually knows if any of this has teeth and if corpos are legitimately worried or if it's more of a feint. I'm generally skeptical of SEC enforcement.

AlbertCory 5y ago

I've read all the comments, and as usual, no one's asked "what do other industries do?" Money-handling, for example (banks, payment systems). If ever there was a Fraud Magnet, that's it. I've heard PayPal described as "a giant fraud-detection system, wrapped around a tiny money-transferring system." And yet, they don't seem to be in the news all the time like "data theft" stories are. Could it be that the legal and regulatory and insurance systems have made it a manageable problem? Someone steals your credit card, your losses are capped. Someone steals your Personally Identifying Information, sorry, pal; change your passwords. So maybe treating PII as the same thing, in every way, as money is the answer.

acdha 5y ago
One useful move would be changing laws around identity theft so companies are liable for any costs incurred from their failure to verify identity, or for reporting credit issues from unvalidated activity. Americans worry about things like SSNs getting breached because they don’t want to get someone else’s bill — if companies were required to check photo ID against a real person (not an uploaded photo) that’d be a much harder crime to make financially viable.
- deleted 5y ago
  [deleted]
- PeterisP 5y ago
  Indeed, it is ridiculous that "identity theft" places a burden on the person whose identity was used - if someone opens an account in my name and the only "evidence" is having provided something that other people (e.g. my mother or spouse) can know, then in any dispute it should be illegal for that fraud/debt to appear on my credit report. That's the way how most of the world has mostly solved identity theft, however, it's not that easy to implement in USA because there's no system of universal secure IDs in USA (by design) - there's a multitude of ID forms, some of them are not really secure (easy to forge, no verification if it was really issued by the institution who did so, no easy process to quickly verify online if the provided credential has been lost/stolen/revoked, etc), and there's a sufficiently large minority of potential customers who don't have a valid ID. It would be helpful to have laws that clearly assign the credit fraud risk fully onto the defrauded companies instead of the people whose identities were used, as experience shows that this would rapidly result in improvements to fraud elimination (there's all kinds of measures that simply are not taken since they add friction), however, a proper solution does require a decent state-run identity system as the foundation of trust, and USA has made a political decision to not have one.

tisthetruth 5y ago

Some might find this interesting: https://vengrams.blogspot.com/2021/09/security-is-layered-process.html?m=1 https://vengrams.blogspot.com/2021/09/security-is-layered-pr...

nimbius 5y ago

as of April 2021 Solarwinds still shows up in Gartner reports read by managers and 'thought leaders.' until they start losing prestige in the trade rags you can expect them to endure as a corporate standard, best practice, industry standard, and "enterprise grade" solution regardless of what common sense and competent system administrators at your company say.

tisthetruth 5y ago

Does this classify as something one can submit a tip about under the SEC.gov's Whistlerblower program?

leptoniscool 5y ago

For sensitive software like these, we should make them open-source so that more eyeballs are looking at it..

lifeisstillgood 5y ago

- Offer amnesty / limited liability / zero liability for losses following breaches - require full disclosure to national data registrars following breaches from now on. - Make source of income as big a deal as KYC - make KYC a "walk in the branch with some photo id". How many of us really need to borrow thousands without going into a store or bank.

Ms-J 5y ago
I'm very confused about your last bullet point. I don't use physical banks for my finances and do all my finances online (like many people). I regularly move thousands of Euros and don't see why I would need a physical bank. That would severely impact a lot of people.
- lifeisstillgood 5y ago
  KYC - Know your customer. Someone opens a new account prove you know who that person really is. Basically photo id in branch will end "identity theft", and similar beneficiary owner rules more or less ends money laundering fundamentally, we have as much crime as we are willing to let the banks allow.

a-dub 5y ago

if a public company fails at infosec, and financials or other material nonpublic information is stolen and used to trade, then yea, it's securities fraud.

deleted 5y ago

[deleted]