You're surprised that large companies are incompetent?

My experience has been that the main product of most companies is management politics. Actually shipping product is nearly irrelevant to everyone's daily activities. In some cases, people get punished for being competent.

One company I worked with made it clear they had no interest in listening to competent people. People were promoted for their ability to suck up to management. They got promoted when the projects they managed were delayed, buggy, and generally non-functional. Any competent engineer was summarily drummed out of the company for causing trouble.

Suddenly, I'm feeling like it's time to re-read Catch-22.

By Joseph Heller in 1961? https://amzn.com/dp/B0048WQDIE/ e-book $11.99

I worked here

And in the absence of legislative action the only thing we can do in the meantime is go after Equifax's data sources and customers. I know that Citibank uses Equifax for providing FICO scores to their cardholders. Voicing your concern to banks like Citi and threatening to close your accounts if their relationship with Equifax isn't terminated can be effective if a big enough percentage of Citi's customers complain. An interesting aside, Mint announced on the 6th of September that they were updating their FICO score service to use TransUnion. They had previously used Equifax. That's either an incredible coincedence or they knew about the breach before anyone else and switched providers.

What legislative action could be done? Require companies whose systems have a large impact on peoples lives hire licensed, certified software engineers? There is no such thing. Require them to follow industry standard practices? There is no such thing. Create new regulations governing the manner in which business management addresses concerns raised by developers? There is no such regulatory body.

You can't claim negligence of following industry standard practices when there ARE no industry standard practices. The closest we have in the software field is the work done by NASA on creating legitimately safe code. But companies don't want to follow those sorts of guidelines because they make software development slow and expensive. Sure software development is the primary driver of their businesses existence no matter what industry they are in, but they feel entitled to it being cheap and fast.

Except that there is precedence for these types of standards and laws in other industries:

PCI [0] is an industry standard which is mandated in order to maintain good standing in the payments industry and HIPAA [1] is US legislation which governs the handling of patient health data.

The issue we face is that there is no equivalent for either of these in relation to handling of PII and identity data.

[0] https://www.pcisecuritystandards.org/

[1] https://www.hhs.gov/hipaa/index.html

>What legislative action could be done? Require companies whose systems have a large impact on peoples lives hire licensed, certified software engineers? There is no such thing. Require them to follow industry standard practices? There is no such thing. Create new regulations governing the manner in which business management addresses concerns raised by developers? There is no such regulatory body.

Why there're standards for cars, but no standards for computer systems? I think it's possible to create them. If there're standards, it's easy to define malpractice.

I agree entirely. It's just a matter of there not being any standards yet. I would hope that eventually we can all agree that even though such standards will never be perfect, and their establishment will be contentious, we need to do it for the overall benefit of society. It will mean licensed software engineers are more expensive to companies, companies will be required to respect those engineers and treat them like competent experts rather than functionaries, and even give the engineers the ability to grind the business to a halt if they point out fundamental engineering problems with the system. Companies will hate that. Some of the practices made standard will seem boring, over-cautious, etc to some engineers and some will not be able to pass whatever tests are put in place and engineers will hate that. The licensing itself will probably end up being a way for some functionary body to enrich itself while providing dubious value as is the case with many of the existing engineering licensing bodies. But, despite all that, the overall social benefits would outweigh the negatives. And failure to accept those negatives will leave us in an even worse position.

Here're examples of things that could be included in such standards:

* Passwords should be stored only in salted and hashed form

* Code injection attacks shouldn't be possible

* Personal data should be stored in anonymized form with mapping between real and virtual id stored separately

* Only cryptographic algorithms from the approved list might be used (no MD5)

What could be done? Pass a law that you can not store any data about a person without their explicit consent for each type of data. No blanket opt-in, no shady changes to TOS.

Or Equifax became unresponsive while they investigated, but didn't reveal what was happening. Related, but not via inside info about the hacks.

>purge their PII from a credit authority

I can't see that happening if they do any kind of offsite back up and archiving. They will purge you from the current master, say they purged you, and you'll be none-the-wiser.

The best solution for this would be to enable similar data protection laws like the ones that will become active in 2018 in the EU.

A breach of this law would cost a company 2-4% of their revenue as a fine. Seeing how these big companies operate there would be a lot of breaches.

>The best solution for this would be to enable similar data protection laws like the ones that will become active in 2018 in the EU.

I like GDPR, but a lot of people claim it to be too draconian. We'll see how it works out in EU.

I wish someone would go Mr Robot and corrupt their offsite tape backups with the HVAC system.

This is a unix system! I know this!

They could encrypt each person's data with a unique key.

Then, purging a person's data would come down to deleting that key from the system and from all backups of the keys.

That makes it a bit easier; the set of all keys will typically be a few orders of magnitude smaller than the data, and could be backed up using separate systems. Those systems wouldn't have to be updated often and access could be better controlled.

You would still need procedures checking nobody writes out non-encrypted data (including database keys), but that's doable; a first level scan would just run strings on your raw disks.

Disadvantage is that this would affect performance, especially for reporting services (a query gathering statistics over your customers would have to fetch all your customers' decryption keys)

A step up would be to hand out not bare decryption keys, but pairs (decryption key, expiration time stamp) encrypted with a private key that only your database knows the matching public key of. That allows your database to detect when your applications reuse decryption keys for too long. Depending on application architecture, that pair could even be a triple (decryption key, session key, expiration time stamp), and 'encryption' of course should use a salt.

> too-big-to-improve

Love that!

> _involuntarily_

This is probably part of the explanation.