3 ms·

If what's being disclosed is of the nature of the Pearson hack (theft of student records) then great. But there are probably thousands of hacks that don't resul

by bink 5y ago

If what's being disclosed is of the nature of the Pearson hack (theft of student records) then great. But there are probably thousands of hacks that don't result in the disclosure of PII or other confidential information. I can understand companies being worried that a compromise of a test system with no access to sensitive data -- which they normally wouldn't be required to disclose -- could make them look bad. But at the same time they're all being required to disclose this info so at least there's safety in numbers.

toomuchtodo 5y ago
I agree that a breach of a test system with no access to sensitive information or digital property (information, source code, binaries, etc) and no ability to pivot from said test system to other systems should not require reporting. To pick an example, that's not what's happening with S3 buckets and Mongo instances (where vast amounts of personal and or sensitive information is being leaked). That's not what happened with Equifax, T-Mobile, Solarwinds, Colonial Pipeline, Pearson, CNA Insurance, etc. You have to hold the feet of these businesses to the fire, and if they don't perform, dissolve them after repeated regulatory failures (just as Arthur Andersen had happen after Enron's failure, or FDIC would part out a bank after insolvency). https://www.reuters.com/technology/hackers-demand-70-million-liberate-data-held-by-companies-hit-mass-cyberattack-2021-07-05/ https://www.reuters.com/technology/hackers-demand-70-million... (July 2021: Up to 1,500 businesses affected by ransomware attack, U.S. firm's CEO says) (disclosure: infosec practitioner)
- elliekelly 5y ago
  I think how and why the breach occurred matters more than what information was accessed. In asset management, for example, when you’re dealing with an error you don’t just look at the dollar amount. Maybe the error only cost a couple thousand dollars today (or maybe it even made money!) but the exact same error on another trading day could just have easily been ten, or a hundred, or even a thousand times more costly. That the error happened at all is the material event. And that’s why there’s no such thing as a de minimus trading error. Sometimes you just get lucky in the magnitude of the impact. Even if it didn’t cost you anything you still need to address the weak point that allowed the error to happen in the first place. So even if a system with absolutely no information was breached if your other system(s) use(s) the same or similar security then it doesn’t really matter that nothing was taken. The breach could still material (and require disclosure) because it’s exposed a material security vulnerability.
  - toomuchtodo 5y ago
    Lots of nuance that can’t fit into a single thread.

by bink 5y ago

toomuchtodo 5y ago

I agree that a breach of a test system with no access to sensitive information or digital property (information, source code, binaries, etc) and no ability to pivot from said test system to other systems should not require reporting. To pick an example, that's not what's happening with S3 buckets and Mongo instances (where vast amounts of personal and or sensitive information is being leaked). That's not what happened with Equifax, T-Mobile, Solarwinds, Colonial Pipeline, Pearson, CNA Insurance, etc. You have to hold the feet of these businesses to the fire, and if they don't perform, dissolve them after repeated regulatory failures (just as Arthur Andersen had happen after Enron's failure, or FDIC would part out a bank after insolvency). https://www.reuters.com/technology/hackers-demand-70-million-liberate-data-held-by-companies-hit-mass-cyberattack-2021-07-05/ https://www.reuters.com/technology/hackers-demand-70-million... (July 2021: Up to 1,500 businesses affected by ransomware attack, U.S. firm's CEO says) (disclosure: infosec practitioner)

elliekelly 5y ago
I think how and why the breach occurred matters more than what information was accessed. In asset management, for example, when you’re dealing with an error you don’t just look at the dollar amount. Maybe the error only cost a couple thousand dollars today (or maybe it even made money!) but the exact same error on another trading day could just have easily been ten, or a hundred, or even a thousand times more costly. That the error happened at all is the material event. And that’s why there’s no such thing as a de minimus trading error. Sometimes you just get lucky in the magnitude of the impact. Even if it didn’t cost you anything you still need to address the weak point that allowed the error to happen in the first place. So even if a system with absolutely no information was breached if your other system(s) use(s) the same or similar security then it doesn’t really matter that nothing was taken. The breach could still material (and require disclosure) because it’s exposed a material security vulnerability.
- toomuchtodo 5y ago
  Lots of nuance that can’t fit into a single thread.