4 ms·

you are talking about human problems. people clicking links. people typing their passwords into foreign web forms. software engineers wont magically fix exec

• SixSigma 12y ago
  > software engineers wont magically fix executives handing over credentials to hackers and all those important files were just lying around You can't project a film without a dedicated digital link to Sony's servers in London authorising it. For some movies they send personnel to your cinema to record the audience with IR cameras. For some movies you are not allowed to let the staff watch the film for free.
  • akshatpradhan 12y ago
    > and all those important files were just lying around That's it. Whether a designer was comprised through a phishing attack or a physical door with access to the sensitive environment was left unlocked, there were clearly no controls in place to manage all the files just laying around like money under a mattress.
  • dredmorbius 12y ago
    How much of that is really security vs. excercising power and control over a market?
    • SixSigma 12y ago
      If they can find the money and staff to implement securing third party cinemas to prevent copyright infringement by members of the public, perhaps they should spend a few dollars to secure their own premises.
      • dredmorbius 12y ago
        People in cinemas with cameras are physically detectable. Network attacks on infrastructure and/or exfiltration by rogue (or rouge) elements within your own workforce are vastly more difficult to detect. Not impossible, but they involve both violations of trust and allegiance, and plausible cover under other activities. Though, once you're aware of / suspect such exfiltration, there are generally a limited number of places to look for suspects / points of access.
        • SixSigma 12y ago
          I should have made more of the fact that to screen the movie on your own projector you have to have a dedicated ISDN line to Sony in London which authenticates your machine with an online DRM system. You also have to give them a share of your ticket sales, provide sales figures and you cannot offer discounted tickets for concessions or special offers.
          • dredmorbius 12y ago
            I understand. Much of that is effectively exercising control over the market venue though. The studio gets to specify which facilities do or don't meet the standards required to show their content. To that extent, the technical restrictions are less about keeping the content from being pirated (there are plenty of other leak channels, typically pre-release review copies, which have their own copy controls, yes), and far more about keeping cinemas beholden to the studio vassal lords.
• akshatpradhan 12y ago
  Security is multiple layers. A phishing attack (as you described) should only gets you 1 layer deep, it shouldn't give you access to everything. You still need to bypass the rest of the controls to get the delicious sensitive data. With a leak like this (100 TB of sensitive SSNs, Salaries, and Movies leaked), there clearly weren't very many controls, if any. I think you're thinking too much about UX, Passwords, and phishing links when you're forgetting all the other layers that a usable security environment can provide without the needs of passwords (e.g. authorization control, segmented file servers for each department). A security engineer can definitely create a very safe and secure environment WITHOUT negatively impacting the usability, experience, or workflow of the creatives working on their designs and art.