3 ms·

They didn't blame the anti malware. In the blog post[0] all they say is > This machine was compromised on December 16, 2022. The malware was not detected by ou

They didn't blame the anti malware. In the blog post[0] all they say is > This machine was compromised on December 16, 2022. The malware was not detected by our antivirus software That's not blaming that's telling people that their antivirus didn't detect it. If that wasn't there, people would be talking about why they didn't use X antivirus which would probably detect it. > CircleCI have sufficient logging, however, failed to do fraud analysis to detect irregular access. This is a significant move of the goalposts. Of course CircleCI messed up, but to go back to the OP's point of "nobody should have that much access to production", well that's just not true. [0] https://circleci.com/blog/jan-4-2023-incident-report/ https://circleci.com/blog/jan-4-2023-incident-report/

oxfordmale 4y ago
I can't judge if their employees need that much access to production. However, if they need this, you need a detection mechanism. It doesn't have to be advanced; a threshold on the number of production keys accessed per day is sufficient. It should raise the alarm to the manager in question, who can then confirm if this is expected behaviour given the tasks assigned to the employee in question.
- maccard 4y ago
  Again I'm not saying circle CI didn't mess up, but that's orthogonal to whether or not someone has access to customer data.
  - oxfordmale 4y ago
    Not necessarily. AWS engineers cannot access your encryption keys unless you give them explicit permissions. They even offer Nitro enclaves where AWS Engineers can never access your keys. Giving access to customer data to your staff by default is a design decision and can be avoided. However, in the end, it is a cost-benefit analysis where you have to decide how much you care about your customer's security. I have worked for enough start-ups/growth companies to know the value put on customers' security is sometimes shockingly low.

oxfordmale 4y ago

I can't judge if their employees need that much access to production. However, if they need this, you need a detection mechanism. It doesn't have to be advanced; a threshold on the number of production keys accessed per day is sufficient. It should raise the alarm to the manager in question, who can then confirm if this is expected behaviour given the tasks assigned to the employee in question.

maccard 4y ago
Again I'm not saying circle CI didn't mess up, but that's orthogonal to whether or not someone has access to customer data.
- oxfordmale 4y ago
  Not necessarily. AWS engineers cannot access your encryption keys unless you give them explicit permissions. They even offer Nitro enclaves where AWS Engineers can never access your keys. Giving access to customer data to your staff by default is a design decision and can be avoided. However, in the end, it is a cost-benefit analysis where you have to decide how much you care about your customer's security. I have worked for enough start-ups/growth companies to know the value put on customers' security is sometimes shockingly low.