5 ms·
It says the company claimed that the credential leak was discovered and remediated 18 months ago, meanwhile the leaked credentials were still working as of a mo
by alwa 2y ago
It says the company claimed that the credential leak was discovered and remediated 18 months ago, meanwhile the leaked credentials were still working as of a month ago.
Is this level of governance and sophistication really typical of vendors in this space? Sprawling enterprises I can imagine losing track of the odd place or two where the credentials are used, but a vendor who only does one thing, specifically a high-trust thing like this?
Even if they don’t have the wherewithal to be thorough in-house, am I confused to imagine that such a firm would have to carry insurance, which would tend to bring in specialists to make sure this kind of remediation is done right?
- jdp23 2y agoYes, it's very typical. There are almost never any consequences for actions like this.
- wepple 2y ago> but a vendor who only does one thing, specifically a high-trust thing like this? They’re not in the business of being trustworthy or secure, it’s just another software shop trying to grow product. > which would tend to bring in specialists to make sure this kind of remediation is done right? Ideally, sure. In reality an insurance company has many thousands of customers, they can’t possibly do any real assurance beyond basic compliance. Managing access and credentials is a hard problem for well staffed security teams, let alone a single compliance auditor.
- dragonwriter 2y agoIts not a high-trust thing, these vendors exist largely because it gives the organizations with direct relations with consumers a step of removal when a breach occurs; they are blame-outsourcing firms.
- judge2020 2y agoSure, but companies also don’t want to deal with building the system themselves (especially if you want to support multiple countries) and dealing with potentially doing something wrong like violating anti-discrimination laws.
- lesuorac 2y agoSurely you have some reasonability to vet your supply chain. Not to say that your vendors have to be perfect, but if they have a known credential leak for 18 months that's pretty negligent.
- EasyMark 2y agoWhy are they keeping a copy is what I’d like to know. It’s enough to know they check it, and verified it, so then they can delete it. Why keep copies at all ??or at least blank out critical parts that aren’t public knowledge. This is so stupid.
- rblatz 2y agoRetention policies are likely set by the client. That’s how it works with the vendors I’ve worked with in this space, but I haven’t worked with this specific vendor.
- olalonde 2y agoProbably because government regulations require it. I know it's a requirement for AML/KYC which many of these companies are subject to.
- BoredPositron 2y agoMaybe but why are they still hot?
- threecheese 2y agoThey have to be hot, otherwise they couldn’t monetize that data in every other way.
- olalonde 2y agoHot?
- BoredPositron 2y agoBackblaze has a nice blog post about it. https://www.backblaze.com/blog/whats-the-diff-hot-and-cold-data-storage/ https://www.backblaze.com/blog/whats-the-diff-hot-and-cold-d...
- chefandy 2y agoIf you need to check someone's government ID, you probably expect to have to go to court or otherwise deal with the government over it at some point. Being able to show why you thought it was someone, not simply that you thought it was someone, is important.
- deleted 2y ago[deleted]