4 ms·
Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enou
by bastawhiz 2y ago
Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.
- stickfigure 2y agoMoney can't buy competence, at least not at organizational scale.
- cqqxo4zV46cp 2y agoSure, but “incentivise a business to do something, and they’re more likely to do it” is still true.
- janalsncm 2y agoFine, but they can clearly afford to pay for a lack of it.
- vuln 2y agoFine is cheaper than solving compliance issues. Many such cases unfortunately.
- bastawhiz 2y agoMaybe not for execs, but if not for money you literally couldn't hire competent security folks
- mozman 2y agoEnriching shareholders is exactly what they are required to do. What, nobody is allowed to make money anymore?
- Slyfox33 2y agoNo, they shouldn't be allowed to fuck over their customers at ever turn so they can be greedy. The suggestion that we should be more worried about how much money the AT&T execs and shareholders make over their needs of their 100 million customers is bizarre.
- balex 2y agoThose are not mutually exclusive.
- bastawhiz 2y agoSure, and then it's the government's job to ensure the shareholders lose their money when the company loses a hundred million customers' records. So yeah, it turns out that when you pay yourself instead of doing right by your customers, I think you shouldn't be allowed to make a profit.
- _zoltan_ 2y agothe number 1 job of a company is to enrich shareholders.
- chasd00 2y agoIt was snowflake’s lack of security that did this not ATT. Not saying ATT is a paragon of security or anything but snowflake was where the hack took place.
- jonhohle 2y agoA vendor’s security is the clients security. Companies might choose a vendor for CYA in these instances, but if someone decides to send all of their internal business data to a third party, they better have a pretty good idea what will happen if that third party fails.
- fauigerzigerk 2y agoWhat do you know about Snowflake's role in this? According to the article, Snowflake says that they offered 2FA and AT&T didn't use it. Perhaps that's not the whole story, but if true then blame certainly lies with AT&T to a significant degree.
- gregw2 2y agoIt’s mostly AT&Ts fault but it’s sort of a side effect of Snowflake making their product easy to use and most of the industry overlooking credential reuse risks. Databases are not historically internet facing so data compromise also meant getting network access. But Snowflake provided web access to your database so they were “easy to use” database as a service (“cloud data warehouse”). Snowflake did not offer you a way to host data within your network or within your dedicated subnets within a cloud provider, so companies could not solely rely on those networking barriers to limit malicious counterparties. Snowflake has apparently begun requiring MFA for new accounts since this incident I’ve heard. If shutting the gate after the horses have left implies culpability, Snowflake has some.
- wrs 2y agoSnowflake has the same shared-responsibility structure as any other cloud provider: they provide enforcement but you are responsible for setting up and protecting your own credentials and permissions. They can’t impose “security” unilaterally in the abstract.
- vuln 2y agoAnd whom is a large percentage of shareholders?