Marriott hack hits 500M Starwood guests

Re:Marriott hack hits 500M Starwood guests by ryandrake on Friday November 30, 2018 @02:27PM (#18571851)

It’s not “either or”, but as someone who has worked at various places along the spectrum of practices ranging from “default password is password” to DO-178B [1], I greatly prefer environments with strict and rigorous design, testing, change control, and security auditing. The chaos of moving fast and breaking things (and fixing them, and breaking them again, and fixing them again, then getting hacked and having to pull 24 hour days to mitigate...) is a recipe for burnout.

1: https://en.m.wikipedia.org/wiki/DO-178B

[ Parent | on HN ]

Re:Marriott hack hits 500M Starwood guests by notyourday on Friday November 30, 2018 @05:03PM (#18573128)

If DO-178B were to be applied to "internet" I would not be surprised if we were thinking that uucp is amazing invention in 2018.

I'm going to repeat it again - we do not have a security problem with software. We have a risk management problem.

There's absolutely no reason for Marriott store information on previous guests past certain statue of limitations. In fact, they could probably offloaded it to Iron Mountain after 180 days. Storing it online has a certain risk profile. That risk was not correctly evaluated ( probably not evaluated at all ) and hence it was not minimized.

Storing credit card information ( even encrypted ) after the card was charged and transaction creates another risk profile. It also was not evaluated and it was not mitigated.

Businesses are obsessed with data without understanding the risk.

[ Parent | on HN ]