News for hackers. Stuff that matters.

A comment on Governor vows criminal prosecution of reporter who found flaw in state website. Parent comment

Re:Governor vows criminal prosecution of reporter who found ... by throwaway894345 on Thursday October 14, 2021 @02:33PM (#28868108)
It’s not a nice response, but IT needs to be able to answer questions about the extent of a given breach (what info was accessed by whom and when). This is a legal requirement in the case of health information. Ideally people could be courteous while fulfilling their legal obligations, but IT folks aren’t generally chosen for their public relations or customer service skills.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by marcus0x62 on Thursday October 14, 2021 @02:42PM (#28868221)
Yes, and they need to do that based on the forensic data available to them, even if the answer is “we don’t know, it could be everything.”. Asking the person who caused the breach to explain the extent of your data loss is not an acceptable, or reliable, practice.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by throwaway894345 on Thursday October 14, 2021 @03:43PM (#28869005)
I don’t expect that it is sufficient, but it probably gives the IT person something to tell their boss in the short term: “We’ll verify, but he says he only accessed X”.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by frumper on Thursday October 14, 2021 @02:38PM (#28868165)
If he can monitor ip addresses to make sure this guy isn't browsing anymore, then he should be able to check those same logs to answer his own question. If you want people that have zero obligation to help you then you should probably be nice to them. The nefarious criminal isn't going to report things like this to you.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by throwaway894345 on Thursday October 14, 2021 @03:44PM (#28869014)
I already agreed that this doesn’t warrant unkindness.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by ajmurmann on Thursday October 14, 2021 @04:46PM (#28869858)
Assessing the scope of the breach, sure. "Fixing" the breach by monitoring a single IP addresses access patterns not so much. The site needed to be taken down till a mitigation has been deployed.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by throwaway894345 on Thursday October 14, 2021 @05:13PM (#28870200)
Agreed.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by vageli on Thursday October 14, 2021 @02:39PM (#28868179)
In those situations you get a third-party in for forensics, you don't typically ask the people who breached how large the breach is (why would you take them at their word anyway? aren't they incentivized to downplay, etc).
[ Parent | on HN ]