Whistleblower: Ubiquiti Breach “Catastrophic”

Re:Whistleblower: Ubiquiti Breach “Catastrophic” by toomuchtodo on Tuesday March 30, 2021 @02:46PM (#26638633)

The breaches are common, the reporting/discovery of them is not. Security just isn’t a priority for a lot of Orgs, as the consequences are minimal (see: Equifax) due to a lack of regulatory or financial penalty pain when a breach occurs.

“Help yourself to a free year of identify theft insurance” and all that jazz.

[ Parent | on HN ]

Re:Whistleblower: Ubiquiti Breach “Catastrophic” by neuronic on Tuesday March 30, 2021 @03:22PM (#26639141)

This is correct. Worked for a fairly large corp with lots of customer data and while I haven't witnessed breaches of said data it's pretty much a matter of time.

Me and my colleagues always pushed for more secure setups and configs but the common rebuttal was "no need there's a keycloak running several layers above and you need to use a VPN and need access to AWS first, go implement features instead."

I hope for them that no rogue employee decides to play around a bit or that no one stores their credentials in some cloud LastPass account with a '123456qwerty' master password.

[ Parent | on HN ]

Re:Whistleblower: Ubiquiti Breach “Catastrophic” by MattGaiser on Tuesday March 30, 2021 @02:55PM (#26638766)

Discovery of breaches seems to be undesirable in the current environment, if many go undetected.

If you discover, you have to report. If you don’t, odds are nobody will notice/will blame someone else.

[ Parent | on HN ]