CircleCI says hackers stole encryption keys and customers’ source code

Re:CircleCI says hackers stole encryption keys and customers... by BarryMilo on Sunday January 15, 2023 @12:07AM (#34386895)

Hindsight is 20/20 for sure, but for this use case confidentiality seems more important than availability.It is something of an impossible choice, but I've come to think that every service big or small gets hacked sooner or later. I'm thinking being a smaller target is better in that case.

[ Parent | on HN ]

Re:CircleCI says hackers stole encryption keys and customers... by chii on Sunday January 15, 2023 @01:26AM (#34387209)

But a smaller target might mean less funds for security, as it's basically a constant overhead.

[ Parent | on HN ]

Re:CircleCI says hackers stole encryption keys and customers... by Xylakant on Sunday January 15, 2023 @04:54AM (#34388193)

I’m fairly confident that in the same breach scenario (laptop with admin permissions taken over), all small orgs would fare worse. The CI system would likely be behind a VPN, but the laptop would likely have those credentials, so it would not stop an attacker.

A small, 20 person org has maybe 2 people assigned to ops, so monitoring and breach detection is likely worse.

Now, a small org may be a less attractive target and some orgs can have top notch security people, but on average, the trade-off is likely not in favor of hosting your own.

[ Parent | on HN ]