Re:Good Heavens 10M Impacted in Pray.com Data Exposure
by i_haz_rabies on Monday November 23, 2020 @10:32AM
(#25187762)
Another, somewhat related issue is the fragmenting of teams. Having a few in-house devs, an outsourced team in Argentina, and a few other contractors, all coordinated by non-technical managers. This more or less describes all the projects I've worked on in my career and it creates the ideal conditions for security problems.
Re:Good Heavens 10M Impacted in Pray.com Data Exposure
by mfer on Monday November 23, 2020 @12:26PM
(#25189146)
There are ways to combat that. For example, some clear processes and documentation. This will help many other issues in organizations as well. Someone can have security as part of their KPI. That will put a focus on it.
Re:Good Heavens 10M Impacted in Pray.com Data Exposure
by alisonkisk on Monday November 23, 2020 @10:49AM
(#25187981)
I don't think it's possible for a sub-$1B consumer operation to be secure, unless they operate inside a very tight sandbox where all the data and processing live inside a Google/Apple/similar sandbox. If the data is managed by the vendor system (which includes most data-monetization plays), it's leaked. Security is too complicated and expensive to get right.
1. Security everywhere is an after thought. How many people have performed a threat analysis of the app they're working on? How many have management who will slow down velocity on features to put the time in to securing personal information?
When the culture isn't there the training isn't there either.
2. I don't know if it's the case here but, in the move to move more work on to app developers (ops, etc) there is only so much they can learn while still delivering on the things. How much of the reality of overloading app developers adds to this?