I'm pretty tired of companies telling me that it's fine for them to hoover up extremely sensitive information like my social security number and then turning around after a breach and saying, "well, there was nothing we could do."
It can't be both. If it's impossible to secure companies, then maybe Merriott shouldn't be asking for anybody's real name when they sign up for a hotel. Maybe we should stop using credit agencies for identity verification and start investing government resources into a separate 2-factor system. Maybe you should have a legally protected right to lie to businesses that ask for your personal information.
Equifax leaked personal information for 50% of the US population. If you were voting, and there was a 50% chance that your ballet and voting history was going to be leaked publicly after the election, you would expect either:
A) Someone is so incompetent that they're going to jail, or
B) The system we're using is so fundamentally broken that we need to rethink the core paradigms of how it's built.
To me, a report like this sounds like the House is saying that where corporate security is concerned, B is the answer.
It's important to distinguish that it wasn't actually Marriott that had the data breach. It was starwoods resorts, now a marriott owned entity, but at the time of the breach it was not a marriott property. Marriott is being attributed to the guilty party b/c they now own starwood, but Marriott's systems were never breached, so marriott should keep doing what they are doing (presumably) and transition all the starwood systems over to the more secure marriott systems (which I believe they already said they are doing).
Got close to pushing them to a centralized database (instead of the per-property Access database), but left before we could finalize that project. Ugh, and the reports I had to design... they wanted smaller than 7 point font on legal paper that would then be faxed. Every property would fax quarterly reports generated by my software for board review.
Interesting times.
That being said, between the recent Google+ breaches, to the older Target breaches, it increasingly feels like I'm flipping a coin when I trust companies with data.
Based on Marriott's handling of this breach, they seem to be decent at security. But I don't know how as a consumer I could tell that in advance of all of this.
M&A is a culprit in no small number of these cases, so let's be crystal clear: M&A does not absolve anyone of responsibility. Let me know when the underwriting bankers have their bonuses garnished for lack of due diligence, and then you can tell me about how "it wasn't actually Marriott that had the data breach". Let's say it loudly and clearly: no, it was Marriott that had the data breach.
So I don't actually feel a ton of ill will to them, even though I agree that doesn't absolve them of the fact that they bought it, and it is now very much their problem to deal with. It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you.
Having said that, this kind of underscores what I was talking about above. If Marriott themselves couldn't tell in advance that the company they were buying was an insecure liability, how the heck am I supposed to be able to tell?
If it's not feasible for a company like Marriott or Verizon to know in advance of an acquisition which companies are secure and which companies aren't, consumers have no chance. There's no feasible way for a consumer to protect themselves in that world.
Strongly disagree, this is playing with variables.
Marriott2016 + Starwood2016 = Marriott2017.
Marriott, the present day company, absolutely includes the company that had the "control or agency to stop it".
> it would have just meant the breach was someone else's problem
This isn't a wash. Tort is only effective if the party responsible gets punished, so it's very important which party gets punished. If Marriott had discovered the breach in due diligence, the Starwood investors' payout would have taken a big hit.
As it happens, there's two behaviors that need to be disincentivized: Starwood designed faulty systems, and pawned off its ramshackle legacy crap to the highest bidder; and Marriott2016 (much like Equifax) glommed together so many legacy systems that the likelihood of breach intensified (though to Marriott's credit, the attack doesn't seem to have escalated out of the former Starwood into the parent systems. I'd still like to see steep fines imposed, but way smaller than on Equifax, proportional to that contained scope).
The penalty on Marriott2017 should be steep enough to encourage future buyers to step up their due diligence enough to put the acquiree's payout at risk, while also rewarding Marriott for catching the leak before escalation.
> It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you.
I like your analogy a lot.
This is a good point that I wasn't considering. It's not like Starwood vanished when it got acquired. It's still there, it just got rolled up into Marriott. So even if I wasn't mad at Marriott2016, most of the people who I am mad at are currently working at Marriott2017.
> Starwood designed faulty systems, and pawned off its ramshackle legacy crap to the highest bidder
Also agreed on penalties, and that's a good way of phrasing the problem. I don't think that Marriott should be let off the hook for having to deal with the breach. And while I've been trying not to criticize their security response, their social response has basically been, "look over there, free credit monitoring," which is clearly insufficient.
Sending some fall guy to jail is shooting the messenger. The message from the stockholders is: we don't care about security or privacy. The message the feds should send back to them is: well you should.
Conversely, no one's going to "rethink the core paradigms" without some money on the line.
Establish standards for the value of stolen data. Something like the worst possible case. So for Equifax, which is potentially a gold mine for identity theft, fine them the average stolen identity cost (~$1300), for each of the 143 million records. 200 billion dollars (probably even 20 billion) seems it would be sufficient enough incentive to properly secure our data.
I also suspect we would need some kind of regular auditing, to ensure companies could afford a breach. Something like this would be a substantial drain on startups, as it would add another significant risk factor.
In the long run, what probably needs to happen is some kind of "data insurance", and we just expect that all companies working with our personal data carry it (or possibly even legislate that they carry it, similar to automobiles). It would make things easier for startups, who would pay much cheaper rates while their adoption was low, while also incentivizing them to limit their data collection to only what they needed.
Disclaimer: I work in the insurance industry, focused particularly on property insurance for disaster prone areas. Lately it feels like there are a lot of parallels between how personal data is stored these days, and Florida in the 90s.
Most organizations I've seen have a very complicated risk management formula to determine how much they're willing to spend on things like cybersecurity. I simplified it my original comment, but from what I've seen in the current state of things, insurance is typically on the side of the equation that justifies spending less on security, not more.
> Warren wants to eliminate the huge financial incentives that entice CEOs to flush cash out to shareholders rather than reinvest in businesses. She wants to curb corporations’ political activities. And for the biggest corporations, she’s proposing a dramatic step that would ensure workers and not just shareholders get a voice on big strategic decisions.
Warren hopes this will spur a return to greater corporate responsibility, and bring back some other aspects of the more egalitarian era of American capitalism post-World War II — more business investment, more meaningful career ladders for workers, more financial stability, and higher pay.
https://www.vox.com/2018/8/15/17683022/elizabeth-warren-acco...
More details here:
https://www.theguardian.com/commentisfree/2018/aug/18/capita...
On this point, I can see no other explanation except that government and business are colluding against the people whose data is being leaked in order to normalize a lack of privacy. Token fines are handed out on the order of seconds worth of annual profit, sometimes minutes, but nobody's going to jail, certainly nobody in the boardroom or executive bathroom. Because fuck you that's why.
Not only this, but we certainly aren't going to be able to sue as individuals over it, but why not? Why does personal data only have a value when someone sells it, why not at rest as well? These leaks contribute to financial criteria that are used to determine interest rates paid on loans, e.g., so a number value is calculable. I'm not holding my breath.
Target should have had to close stores to close the shortfall from leak penalties, and Equifax and Marriott should have their corporate charters dissolved.
Stern punishments for fraud/lying/cheating on security audits would be great, but punishments for "incompetence" would have the opposite effect.
I believe this happens in transportation sectors often enough to be an important skill in those industries.
To be sure, the subjective measure I'm talking about is laws that don't yet exist, but if you have a problem with law enforcement as a monster of subjectivity I can't speak to that.
most competent cybersec people are wary of inevitably being fired because of some random breach that is mostly out of their control
I would like to hear of instances where this has ever happened, and at any rate it would be an absolute-minimum penalty in a Target/Equifax/Marriott context.
punishments for "incompetence" would have the opposite effect.
I don't understand the scare quotes, but like I said (or tried to imply), bad things happening on someone's watch where best practices are established and not followed are criminally punished often enough to mention.
HN's probably going to frequency-limit me after this, so don't think I'm not reading just because pg won't let me post for the rest of the day.
There's a significant difference between cybersec and other sectors: most other sectors don't have groups of extremely well-funded, malicious attackers trying to circumvent everything you do. We send people to jail for failing to do things that are entirely in their control (a train conductor falling asleep, a CFO falsifying records, etc). But in situations where there are malicious outside forces, we don't punish the victims.
For civil engineers, sure they are legally liable for not building something up to established codes or if they knowingly defraud inspectors, etc, but if a terrorist blows up a bridge, we don't send the bridge's engineer to prison (nor do we send the director of the FBI to prison for failing to prevent the bombing). If a burglar is able to sneak past the security guard at the mall, maybe the guard gets fired, but we certainly don't send him or his boss to prison, either.
> I would like to hear of instances where this has ever happened, and at any rate it would be an absolute-minimum penalty in a Target/Equifax/Marriott context.
During my career of cybersec consulting I saw it often enough for it to easily be considered status quo. Security at most companies is basically like playing a game of hot potato: everyone knows it's just a matter of time until the next breach is discovered. This is especially the case in most companies that are actively looking for a CISO: the reason you're probably looking for a new CISO in the first place is because your last one was fired/"retired"/left, or you didn't have one in the first place.
So now a new CISO joins, and they're responsible for reforming what is most likely a steaming pile of shit. Unfortunately, it can take years to move the needle even a little bit in terms of security maturity. So the new CISO might be 9 months into revamping the security program, but hackers just breached the network using an exploit that was left there by the last guy and that the CISO just hasn't gotten anywhere near being able to remediate yet. Or, maybe the hackers used a 0-day against the company that literally nobody even knew about until today. There was nothing the CISO could realistically do, but the C-suite is pissed, stockholders are pissed, customers are pissed, and someone's head needs to roll. So who gets fired (or is forced to "retire")? The CISO, of course. (incidentally, this means a new CISO has to be hired, which is going to significantly delay any security remediation efforts, which just means the company is exposed even longer).
I've personally seen this happen at multiple companies, and I've heard countless other similar stories from my colleagues. At my (very large) consulting firm, almost everyone I worked with that had >10 years experience had been offered a CISO position at one of our clients, but almost all refused it, because like I said, it's pretty much an inevitability that taking that job will just result in them being used as the sacrificial lamb in 12-24 months when they get hacked by something that's hardly even their fault. CISO is, based on what I've seen after years in the industry, not a coveted position whatsoever.
It's also funny that you mentioned the Target hack specifically, as the Target breach wasn't caused by anything I'd consider even remotely close to "incompetence". At the time, Target was actually known (at least among my colleagues) for having one of the best cybersec teams in corporate America. They did everything by the book, and the breach wasn't caused by any unpatched vulnerabilities or misconfigured systems. It was caused by something that nobody at the time even knew to watch out for. It was pretty much as close to "they really did do their best, but unfortunately their best wasn't good enough" as can be. And if you start jailing people for doing their best, or even firing them for it, pretty soon we just won't have anyone working in cybersec at all.
> I don't understand the scare quotes, but like I said (or tried to imply), bad things happening on someone's watch where best practices are established and not followed are criminally punished often enough to mention.
The "scare quotes" are specifically around the world "incompetence" because of what it implies. If you consider every CISO who didn't achieve absolute 100% breach prevention as "incompetent", then that would be nearly every single CISO in the country. In the cybersec industry, there's a famous quote by the director of the FBI: "there are two types of companies: those that have been hacked, and those that just don't know yet that they've been hacked". (again, it's a game of hot potato). If that's not what you mean by "incompetence", okay, fine, but who does get to decide the definition of incompetence? Who gets to draw the line between "incompetent" and "competent but just unlucky"? The public? A jury? A judge? Cybersecurity is hardly an area that even the most educated judges and juries understand. Nobody with half a head on their shoulders is going to take the risk of jail time just because an 80 year old technophobe judge couldn't wrap their head around who was truly at fault for a 0-day breach.
You're saying that incompetence is not the reason that breaches are happening. Fine. But breaches are still happening, so maybe Target shouldn't be storing credit cards at all. I have insecure things in my life that I know are insecure. I know that probably at some point in my life someone, somewhere will break into my car, so I don't store tons of money and jewelry inside it.
We know what the solution is to a data store that's fundamentally insecure and can't be fixed -- you limit the amount of sensitive data inside of it so that when it is hacked, the damages are mitigated. We already see this in many large companies with their email retention policies. Many companies take the view, "we don't know when we're going to be embroiled in some random, crazy legal battle. So we delete old emails whenever we're legally allowed to."
I understand where you're coming from with the perspective that incompetence is hard to measure, and to an extent, I agree with you. But the data breaches are just as damaging to consumers regardless of who's at fault. I have very little sympathy for a company that says, "we shouldn't suffer because of a breach because we couldn't reasonably prevent it." Consumers can't prevent breaches.
Companies should face an equivalent risk to consumers, so that they're incentivized to reduce that risk in any way they can. That doesn't need to be at the CISCO level, I'd prefer it be at the shareholder level.
If there's a Occam-friendly alternative explanation I'm all ears, but I've been looking for a while and I haven't found anything.
A bunch of different parties failed at a really hard thing, lots of times over many years, and some laws that are tough to write well haven't gotten written yet. Collusion most foul.
We need better laws with stricter fines, and the pressure has to come from the voters and from the subject-matter-experts, because you're absolutely right that it won't come from the corporations anytime soon.
A bunch of different parties failed at a really hard thing, lots of times over many years
There's a concept in US law called the "attractive nuisance," and the fact that data leaks have happened "lots of times over many years" raises that charge to negligence if not recklessness.
Suit yourself. The only thing scarier than believing it's all a big conspiracy, is admitting that no one anywhere is in control.
"A loose affiliation of millionaires, billionaires, and baby..."
This is interesting. I almost always fudge my birthday a bit when asked for it. If I'm applying for a loan or opening a bank account or dealing with the government, of course I provide the correct information. But it feels like a really bad idea to provide my actual birthday to strangers whether on the Internet or not.
Gov't issued Yubikeys or a new gov't issued "smart ID" with a 2-factor system as part of it?
I can only imagine that this point becomes lawsuits that span decades.
It's absolutely ridiculous that any kind of a security team -- not to mention one that's supposedly safeguarding such an immense amount of data -- could let monitoring certificates expire at all. It's almost inconceivable that they could let seventy nine certificates that are required for security monitoring expire for months on-end.
I've worked in security for my whole career, and I'm firmly of the optimistic belief that someday, far fewer security-minded people will be needed to keep organizations secure. This is an excellent counterpoint to my argument, though: even the people who supposedly specialize in keeping things secure can apparently be absolutely clueless.
Even worse, the "seventy nine" figure was just the certs that were associated with "critical" systems. The total number of expired certs was at least 324.
> At the time of the breach, however, Equifax had allowed at least 324 of its SSL certificates to expire. Seventy-nine of the expired certificates were for devices monitoring highly business critical domains.
(from pg 70 of the report)
We don't really know what the certs were used for (eg, whether it was needed to decrypt traffic), or just as part of the reporting... And yes, the team is responsible for keeping them valid, but... this isn't the first time that cert expiration "broke" something and left us worse off than with no SSL at all.
It seems like these systems could only work by either using some heuristic like data volume to decide when something is being "exfiltrated", which isn't nearly as useful, or by whitelisting allowed communications, which seems absurd.
What am I missing?
On that proxy outbound traffic destination host or IPs would be compared to a list of known destination, and rejected if not match is found.
These methods are not 100%, but they do help add another layer to the security process.
Of course, now this means you just need to detect that sort of proxying, which may be easier.
Detecting exfil sucks and is hard.
I totally agree that 100% exfil detection is near impossible. But if you were going to try to get close to it, this is one of the world's databases where you really would want to. Their entire model is about collecting a shit ton of information and providing very heavily controlled access to it. Very well paid people should have spent a lot of time examining how to balance the need to pull in data from many sources, while providing only monetized ways to actually retrieve said data. They're like an old-timey pirate captain, who spends most of her time roaming all over the place in the hopes of being able to plunder someone else's treasure, then hiding said treasure in a safe place.
Except they really didn't take the hiding the treasure part very seriously. ;)
I would not consider the ability to proxy traffic much of a new capability for attackers. You can do it trivially with a single SSH command. Even a script kiddy with automated tooling should be able to handle this.
Agree that detecting exfil when you have sensitive data is very important though. Just that it takes a lot of work to protect against, and a ton of work to detect.
Won't be perfectly secure, but it diminishes a major area of risk.
(There are other architectures that will accomplish the same thing, the key is that if a machine can access the user databases, you should be drastically limiting what kind of outgoing connections it can make.)
This doesn't have to mean that they have full, unrestricted access. Access to data may mean that they could get raw records via some internal API. That API may still have logging, access control, DoS protection, etc.
Just like you can detect and prevent an external person from scraping your website in most cases, you can detect some internal service requesting way more than an average hourly number of records. Or with a better audit - specific verifiable entity (signed employee requests, external request id markers, etc.) requesting more than they should.
That assumes you have well designed system with multiple tiers and assume no trust. It's not possible if every service connects to the same database with yolo-root-access.
>Although the ACIS application required access to only three databases within the Equifax environment to perform its business function, the ACIS application was not segmented off from other, unrelated databases. As a result, the attackers used the application credentials to gain access to 48 unrelated databases outside of the ACIS environment.
If you cannot store data securely then you should not profit from that data. Business models that insecurely store consumer data should not be viable.
* Network traffic capture for deferred analysis * Egress analysis (including decrypting SSL/HTTPS)
The first approach is, IMO, more realistic. Although you can't prevent the exfiltration, you can detect it lazily after it's happened, including where it went, what was sent, etc. Although I'm sure several companies support this, [Eastwind Networks](https://www.eastwindnetworks.com/) does a great job for Cloud and on-prem workloads.
The second option, while more thorough, requires big boxes to run, doesn't scale well, is hard to install on clients (the only way I know to "break" HTTPS is to install a custom CA on all clients and MITM all public traffic, which would break for sites using HSTS and HTTP Public Key Pinning). It's only vaguely feasible, and is fraught with issues.
It's of course much more difficult than that in practice, but that's the general idea.
Sure lots of companies can manage legacy software, arguably though Equifax's target on their head is substantially larger than most companies. They are the holy grail of personal data. Nothing should be legacy with them
This is like a loss of primary containment at a nuclear facility and the writeup saying "nuclear plants are hard".
Color me flabbergasted.
But what were you expecting? That the people heavily sponsored by large corps like Equifax will write a nasty report against people that are basically paying their salaries?
Have you ever seen 911 report? After all the investigations, time and money spent, the report basically stated that.. there was a terrorist attack and buildings fell.
Long time ago I gave up on buying popcorn when high caliber political committees reports come out. Bottom line is, "this is America and this is business," and Equifax is in business of making billions of dollars, even if someone forgets to renew expired certificate, the caravan goes on.
Their monitoring system might have been using TLS to communicate the events to their aggregation tool, and when the cert expired, you don't really want log data with potentially confidential/critical security information traversing insecure channels, so they may have had it configured to not send any data if the cert wasn't valid.
As for warnings about the cert, it's possible they (stupidly) configured it to not send warnings, or maybe it was sending warnings but nobody was paying attention. I've seen situations before where such warnings were set to go to XYZ person's mailbox, but XYZ person leaves the company and nobody remembered to update the destination address for the alerts.
> Equifax had allowed over 300 security certificates to expire, including 79 certificates for monitoring business critical domains.
(on page 2 of the Executive Summary)
I've been following the Equifax breach story but this is the first I'm hearing about the expired certificates. That is shockingly bad.
I'm a little disappointed in the final "conclusion" of the report, though. The end of the executive summary basically chalks the breach up to two things: "Equifax's IT management structure was complicated" and "Equifax uses legacy software that is hard to secure". These are valid points, but these are also issues that nearly every single major corporation in the world faces, and yet many of them still manage to prevent (or at least mitigate) major breaches. These aren't good enough reasons to explain why Equifax failed so spectacularly compared to every other bureaucratic company with legacy software.
Also, I know this report isn't meant to be a remediation strategy roadmap, but it's also pretty disappointing that the recommendations section is basically just 3 pages of fluffy, vague, "X and Y should work together to increase cybersecurity" bullshit. Such a high profile incident would have been a great time for the federal government to really show some leadership (or at least strong guidance) in this realm, but they really didn't. I mean hell, at least link your recommendations to the NIST Cybersecurity Framework...