6 ms·

In a very large company like Disney there are often legal data retention requirements from ongoing litigation, which means Corporate Slack might be more complic

In a very large company like Disney there are often legal data retention requirements from ongoing litigation, which means Corporate Slack might be more complicated than the AT&T customer data breach.

deleted 2y ago
[deleted]
Zondartul 2y ago
With how big and aggressive Disney is I'd expect it to be under ongoing litigation 24/7/365.
05 2y ago
Proper logging for retention would surely involve a point where you encrypt the data with a temporary key and then encrypt that key with the public key and only your top brass would have access to the HSM that could decrypt that blob..
- rblatz 2y ago
  Why keep it hot? Physical security is a mostly solved issue for backups unless you are taget d by nation state level actors.
  - tardy_one 2y ago
    Like Sony..
nyrikki 2y ago
Retention doesn't require it to be online. A tape sitting in Iron mountain would have a smaller attack surface and be compliant. Potentially this breach will allow litigation that was financially infeesable for some people. As a former WDIG employee I am not even suggesting anything concrete or that I have any knowledge of unlawful activity. But as someone who also worked in the electronic evidence discovery field, the cost of blind discovery has a chilling effect on lawsuits. Now that targeted discovery is possible, it will be within the budgets of more potential cases. The forever retention was a marketing differentiator for Slack, so this type of events were a risk you have to accept. But all about convenience and not compliance.
- BoredPositron 2y ago
  With how many people in this thread don't see the problem with keeping all data always hot... we are fucked.
  - Aeolun 2y ago
    Hot data is not such a problem with hot security. It’s when your security freezes that it becomes an issue.
    - brookst 2y ago
      But why take the risk? Cold storage is cheaper, more secure, more friendly to a “we have the data but it will take time” defense.
- JSteph22 2y ago
  >Retention doesn't require it to be online. Conversely, offline doesn't mean unhackable/unleakable.
  - nyrikki 2y ago
    As nothing is unhackable, that is a false dicotomy. Why use passwords at all under that line of thinking. That is why we talk about reducing attack surfaces.

deleted 2y ago

[deleted]

Zondartul 2y ago

With how big and aggressive Disney is I'd expect it to be under ongoing litigation 24/7/365.

05 2y ago

Proper logging for retention would surely involve a point where you encrypt the data with a temporary key and then encrypt that key with the public key and only your top brass would have access to the HSM that could decrypt that blob..

rblatz 2y ago
Why keep it hot? Physical security is a mostly solved issue for backups unless you are taget d by nation state level actors.
- tardy_one 2y ago
  Like Sony..

nyrikki 2y ago

Retention doesn't require it to be online. A tape sitting in Iron mountain would have a smaller attack surface and be compliant. Potentially this breach will allow litigation that was financially infeesable for some people. As a former WDIG employee I am not even suggesting anything concrete or that I have any knowledge of unlawful activity. But as someone who also worked in the electronic evidence discovery field, the cost of blind discovery has a chilling effect on lawsuits. Now that targeted discovery is possible, it will be within the budgets of more potential cases. The forever retention was a marketing differentiator for Slack, so this type of events were a risk you have to accept. But all about convenience and not compliance.

BoredPositron 2y ago
With how many people in this thread don't see the problem with keeping all data always hot... we are fucked.
- Aeolun 2y ago
  Hot data is not such a problem with hot security. It’s when your security freezes that it becomes an issue.
  - brookst 2y ago
    But why take the risk? Cold storage is cheaper, more secure, more friendly to a “we have the data but it will take time” defense.
JSteph22 2y ago
>Retention doesn't require it to be online. Conversely, offline doesn't mean unhackable/unleakable.
- nyrikki 2y ago
  As nothing is unhackable, that is a false dicotomy. Why use passwords at all under that line of thinking. That is why we talk about reducing attack surfaces.