2 ms·

Reading this 2 months after the fact feels a bit late, but I guess it’s better for your stock price if these revelations happen with remediation already in hand

by Aeolun 3y ago

Reading this 2 months after the fact feels a bit late, but I guess it’s better for your stock price if these revelations happen with remediation already in hand? Since they didn’t really have reason to believe my data was accessed, maybe that’s ok. I know from firsthand experience how hard rotating all your credentials across the whole org is.

Cthulhu_ 3y ago
The final security report was only released yesterday, and the amount of work they did to make sure all of their systems were secure after the incident was A Lot; two months is pretty quick for a project of that scale IMO.
- Aeolun 3y ago
  Yes, but if after two months they’d found out that customer data had been compromised, that would be a little late for me to do anything about it.
  - nemothekid 3y ago
    What do you expect them to do? It sounds like you are complaining that they weren't able to instantly ascertain if customer data had been compromised.
    - Aeolun 3y ago
      No, I’m saying that if they’d found out after the fact that it had, it could have been bad for me. What I’d expect is a note on the 24th that they’d kicked a threat actor of their Jira system, and that they had no reason to believe the rest of their systems were compromised, but that they were taking action to prevent it from happening again and starting a full investigation. I get that the business might not want to do that if they are not certain there is any cause for alarm. Uncertainty might be even worse for some.
  - eastdakota 3y ago
    Had customer data been impacted we would have disclosed it immediately.
    - htrp 3y ago
      ^ eastdakota is part of the cloudflare mgmt team (CEO)
    - Aeolun 3y ago
      I trust that. Something about having someone consistently show up to explain gives me a lot of faith in the company. My concern was mostly around the situation where you believe it had not been, but it had.
lavezzi 3y ago
Since December 18, new SEC rules require companies to report “material” cybersecurity incidents on a Form 8-K within four business days of their materiality determination. The rule does not set any specific timeline between the incident and the materiality determination, but the materiality determination should be made without 'unreasonable delay'.

by Aeolun 3y ago

Cthulhu_ 3y ago

The final security report was only released yesterday, and the amount of work they did to make sure all of their systems were secure after the incident was A Lot; two months is pretty quick for a project of that scale IMO.

Aeolun 3y ago
Yes, but if after two months they’d found out that customer data had been compromised, that would be a little late for me to do anything about it.
- nemothekid 3y ago
  What do you expect them to do? It sounds like you are complaining that they weren't able to instantly ascertain if customer data had been compromised.
  - Aeolun 3y ago
    No, I’m saying that if they’d found out after the fact that it had, it could have been bad for me. What I’d expect is a note on the 24th that they’d kicked a threat actor of their Jira system, and that they had no reason to believe the rest of their systems were compromised, but that they were taking action to prevent it from happening again and starting a full investigation. I get that the business might not want to do that if they are not certain there is any cause for alarm. Uncertainty might be even worse for some.
- eastdakota 3y ago
  Had customer data been impacted we would have disclosed it immediately.
  - htrp 3y ago
    ^ eastdakota is part of the cloudflare mgmt team (CEO)
  - Aeolun 3y ago
    I trust that. Something about having someone consistently show up to explain gives me a lot of faith in the company. My concern was mostly around the situation where you believe it had not been, but it had.

lavezzi 3y ago

Since December 18, new SEC rules require companies to report “material” cybersecurity incidents on a Form 8-K within four business days of their materiality determination. The rule does not set any specific timeline between the incident and the materiality determination, but the materiality determination should be made without 'unreasonable delay'.