Re:NordVPN confirms it was hacked
by colechristensen on Monday October 21, 2019 @02:02PM
(#21315275)
As a client I can ask for policies, records, 4th party audit reports, etc and choose your vendor based on their ability to answer and the quality of answers.
It's not about contract violations if something like that happens you don't know about, it would have to be willful deception and incompetence of several organizations.
"we could not have known" is an answer you get when what you really mean is "we didn't think to look". If something like this happened and you had done the right things the message would be "vendor X violated their policy, our contracts, and auditors A, B, and C failed due diligence requirements here and here"
"We could not have known" as a response means no one should trust NordVPN because clearly they think they're helpless which means they aren't clever enough to trust my data with.
> you should never have full 100% confidence in someone else's system
It's not about contract violations if something like that happens you don't know about, it would have to be willful deception and incompetence of several organizations.
"we could not have known" is an answer you get when what you really mean is "we didn't think to look". If something like this happened and you had done the right things the message would be "vendor X violated their policy, our contracts, and auditors A, B, and C failed due diligence requirements here and here"
"We could not have known" as a response means no one should trust NordVPN because clearly they think they're helpless which means they aren't clever enough to trust my data with.
> you should never have full 100% confidence in someone else's system
Of course.