8 ms·

Sony Pictures has an operating income (revenue minus expenses) of $501 million per year. They can afford to pay creatives, but they can't afford to pay for a fe

Sony Pictures has an operating income (revenue minus expenses) of $501 million per year. They can afford to pay creatives, but they can't afford to pay for a few more security engineers? Look, I get the creative field costs a lot of money. But Sony Pictures was paying $454,224,070 http://fusion.net/story/30850/ http://fusion.net/story/30850/ in total salaries as of May. Even hiring 5 more security engineers would have gone a long way. That's $1 million if we assume a $200k salary for good security engineers. A drop in the bucket for Sony Pictures. I personally could do a lot with 5 security engineers.

l33tbro 12y ago
Exactly. Let's not engage in this faux polemic about art-v-practicality. Sony are not mumblecore aesthetes from Bushwick. They are a megalith that should have their security locked down hard. Sorry you got owned, but seriously get with consensual reality: hackerfolk tend to hate owners of Big Content like you. Should have seen this coming ...
johansch 12y ago
Security is also incredibly, incredibly hard. Google were hacked quite hard as well, remember?
- valarauca1 12y ago
  The most recent google hack [1] wasn't actually a Google hack. It was just a combined list of various email/password dumps of various hacked webservices over the years. That all ended in @gmail.com My account was included yet my password was 18 months out of date. [1] http://bgr.com/2014/09/10/gmail-hack-how-to-find-out/ http://bgr.com/2014/09/10/gmail-hack-how-to-find-out/
- AnimalMuppet 12y ago
  Google was hacked quite as hard? You mean, where all their employee SSNs were posted online, along with their technology roadmap? No, sorry, I don't remember that. Or was that sarcasm?
basch 12y ago
you are talking about human problems. people clicking links. people typing their passwords into foreign web forms. software engineers wont magically fix executives handing over credentials to hackers. if you were designing a network and interface to access your files, maybe you could design it without resorting to passwords, but that wasn't practical in sonys case. maybe they could have designed their network to notice the data leaving, but again, the hackers could always find a way to win. (physical infiltration of the company and a verizon hotspot?)
- SixSigma 12y ago
  > software engineers wont magically fix executives handing over credentials to hackers and all those important files were just lying around You can't project a film without a dedicated digital link to Sony's servers in London authorising it. For some movies they send personnel to your cinema to record the audience with IR cameras. For some movies you are not allowed to let the staff watch the film for free.
  - akshatpradhan 12y ago
    > and all those important files were just lying around That's it. Whether a designer was comprised through a phishing attack or a physical door with access to the sensitive environment was left unlocked, there were clearly no controls in place to manage all the files just laying around like money under a mattress.
  - dredmorbius 12y ago
    How much of that is really security vs. excercising power and control over a market?
    - SixSigma 12y ago
      If they can find the money and staff to implement securing third party cinemas to prevent copyright infringement by members of the public, perhaps they should spend a few dollars to secure their own premises.
darkarmani 12y ago
> They can afford to pay creatives, but they can't afford to pay for a few more security engineers? So how do you measure their risk and the probability of being damaged? Serious security experts are STILL trying to figure out how to calculate these things. Insurance companies still have trouble "properly" pricing cyber insurance. The insurance companies are doing it, but they are way behind their ability to price for other forms of disasters. So how much should they spend towards cyber security? How far off are they from that amount? We don't know. (well maybe we'll know from the leaked documents).
- akshatpradhan 12y ago
  You do that through a Security Risk Assessment. There are plenty of models (e.g. Octave) out there to help a security engineer conduct a Risk assessment on an organization's infrastructure. Moreover, a Security Risk Assessment is very strongly suggested by any Security Compliance Program that deals with sensitive information. This dump clearly shows personally identifiable information, something that would be easily classified as sensitive (e.g. SSNs). I'm very sure Sony Pictures classified their leaked movies as sensitive since it would cause massive financial loss (which happened) if it was stolen. If anybody was doing a Risk Assessment, protecting this critical part of the infrastructure would have been number 1 on the list. Hackers are even claiming that a physical door with access to the sensitive environment was left unlocked. That's security 101!
GFK_of_xmaspast 12y ago
Why can't they be like Sony Music, and not pay creatives at all.
billions 12y ago
Sony has a culture problem: if it is not a Japanese initiative, it doesn't happen. Unfortunately, the Japanese web executives are at least 10 years behind on Silicon Valley, on knowledge and vision. For as long as there isn't a Japanese security expert, born in Japan and groomed at Sony, Sony will continue taking these types of blows.
TrainedMonkey 12y ago
Let me rephrase the question here, we could either spend $1m on some gobbledegook that those fast talking nerds saying we need, or we could get bigger bonuses. We worked hard and bonuses would be tangible, when asked about how we will know if $1m expenditure a year is working fast talking nerds talk even more quicker about something that amounts to 'nothing bad will happen'. We are arguing here from position of knowledge that guys who make these decisions likely do not have. Should they have it? Probably not, but they definitely should listen to someone who knows and who can present solid risk/cost/benefit analysis that they can understand.
- vacri 12y ago
  Explaining 'how it happened: because human' is not the same as 'shouldn't have to care about security'. In fact, I'd argue that those big bonuses would imply that they're professionals worth the money, and should be making more robust decisions.
  - TrainedMonkey 12y ago
    I completely agree with you that they should know what they are doing and make robust decisions. But when you are at the top, and you tell board what is going on, and you define what it means to be a professional the line blurs. It is very easy to omit certain tail risks by simply not knowing and not taking time to know about them.
- deleted 12y ago
  [deleted]

l33tbro 12y ago

Exactly. Let's not engage in this faux polemic about art-v-practicality. Sony are not mumblecore aesthetes from Bushwick. They are a megalith that should have their security locked down hard. Sorry you got owned, but seriously get with consensual reality: hackerfolk tend to hate owners of Big Content like you. Should have seen this coming ...

johansch 12y ago

Security is also incredibly, incredibly hard. Google were hacked quite hard as well, remember?

valarauca1 12y ago
The most recent google hack [1] wasn't actually a Google hack. It was just a combined list of various email/password dumps of various hacked webservices over the years. That all ended in @gmail.com My account was included yet my password was 18 months out of date. [1] http://bgr.com/2014/09/10/gmail-hack-how-to-find-out/ http://bgr.com/2014/09/10/gmail-hack-how-to-find-out/
AnimalMuppet 12y ago
Google was hacked quite as hard? You mean, where all their employee SSNs were posted online, along with their technology roadmap? No, sorry, I don't remember that. Or was that sarcasm?

basch 12y ago

you are talking about human problems. people clicking links. people typing their passwords into foreign web forms. software engineers wont magically fix executives handing over credentials to hackers. if you were designing a network and interface to access your files, maybe you could design it without resorting to passwords, but that wasn't practical in sonys case. maybe they could have designed their network to notice the data leaving, but again, the hackers could always find a way to win. (physical infiltration of the company and a verizon hotspot?)

SixSigma 12y ago
> software engineers wont magically fix executives handing over credentials to hackers and all those important files were just lying around You can't project a film without a dedicated digital link to Sony's servers in London authorising it. For some movies they send personnel to your cinema to record the audience with IR cameras. For some movies you are not allowed to let the staff watch the film for free.
- akshatpradhan 12y ago
  > and all those important files were just lying around That's it. Whether a designer was comprised through a phishing attack or a physical door with access to the sensitive environment was left unlocked, there were clearly no controls in place to manage all the files just laying around like money under a mattress.
- dredmorbius 12y ago
  How much of that is really security vs. excercising power and control over a market?
  - SixSigma 12y ago
    If they can find the money and staff to implement securing third party cinemas to prevent copyright infringement by members of the public, perhaps they should spend a few dollars to secure their own premises.

darkarmani 12y ago

> They can afford to pay creatives, but they can't afford to pay for a few more security engineers? So how do you measure their risk and the probability of being damaged? Serious security experts are STILL trying to figure out how to calculate these things. Insurance companies still have trouble "properly" pricing cyber insurance. The insurance companies are doing it, but they are way behind their ability to price for other forms of disasters. So how much should they spend towards cyber security? How far off are they from that amount? We don't know. (well maybe we'll know from the leaked documents).

akshatpradhan 12y ago
You do that through a Security Risk Assessment. There are plenty of models (e.g. Octave) out there to help a security engineer conduct a Risk assessment on an organization's infrastructure. Moreover, a Security Risk Assessment is very strongly suggested by any Security Compliance Program that deals with sensitive information. This dump clearly shows personally identifiable information, something that would be easily classified as sensitive (e.g. SSNs). I'm very sure Sony Pictures classified their leaked movies as sensitive since it would cause massive financial loss (which happened) if it was stolen. If anybody was doing a Risk Assessment, protecting this critical part of the infrastructure would have been number 1 on the list. Hackers are even claiming that a physical door with access to the sensitive environment was left unlocked. That's security 101!

GFK_of_xmaspast 12y ago

Why can't they be like Sony Music, and not pay creatives at all.

billions 12y ago

Sony has a culture problem: if it is not a Japanese initiative, it doesn't happen. Unfortunately, the Japanese web executives are at least 10 years behind on Silicon Valley, on knowledge and vision. For as long as there isn't a Japanese security expert, born in Japan and groomed at Sony, Sony will continue taking these types of blows.

TrainedMonkey 12y ago

Let me rephrase the question here, we could either spend $1m on some gobbledegook that those fast talking nerds saying we need, or we could get bigger bonuses. We worked hard and bonuses would be tangible, when asked about how we will know if $1m expenditure a year is working fast talking nerds talk even more quicker about something that amounts to 'nothing bad will happen'. We are arguing here from position of knowledge that guys who make these decisions likely do not have. Should they have it? Probably not, but they definitely should listen to someone who knows and who can present solid risk/cost/benefit analysis that they can understand.

vacri 12y ago
Explaining 'how it happened: because human' is not the same as 'shouldn't have to care about security'. In fact, I'd argue that those big bonuses would imply that they're professionals worth the money, and should be making more robust decisions.
- TrainedMonkey 12y ago
  I completely agree with you that they should know what they are doing and make robust decisions. But when you are at the top, and you tell board what is going on, and you define what it means to be a professional the line blurs. It is very easy to omit certain tail risks by simply not knowing and not taking time to know about them.
deleted 12y ago
[deleted]