{"id":9108,"date":"2017-09-09T16:58:15","date_gmt":"2017-09-09T16:58:15","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/a-perfect-storm-of-corporate-idiocy.html"},"modified":"2017-09-09T16:58:15","modified_gmt":"2017-09-09T16:58:15","slug":"a-perfect-storm-of-corporate-idiocy","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/a-perfect-storm-of-corporate-idiocy.html","title":{"rendered":"A perfect storm of corporate idiocy"},"content":{"rendered":"


\n<\/p>\n

At this point in the game there should be a single page on every corporate website, preferably accessible from its front page, that includes the name and all contact details for the Chief Security Officer, including the last four digits of her social security number. It should be her responsibility to ensure that no one uses this information for nefarious purposes in addition to her daily operations. This honeypot should inspire the this CSO to go to great lengths to protect herself and her company\u2019s data.<\/p>\n

It\u2019s only fair, right?<\/p>\n

This person \u2013 who in Equifax\u2019s case was named John Kelley III and earned nearly $3 million<\/a> for releasing 143 million customer records (about $50 per record) \u2013 should also be the first to be fired during a breach. Further, this person should no longer work in \u201csecurity\u201d and instead be relegated where he can do less damage, perhaps in food service but not food preparation.<\/p>\n

\"\"<\/p>\n

I doubt they\u2019d be trustworthy enough to fry a hamburger.<\/p>\n

I know it\u2019s a little Hunger Games but I think that\u2019s where we are in 2017. Corporate security is an afterthought.<\/p>\n

I propose this for a simple reason: no one else on Equifax\u2019s corporate leadership board<\/a> works on security. There are plenty of folks dedicate to sales and revenue growth but only Kelley has \u201chas responsibility for legal services, global sourcing, security and compliance, government and legislative relations and more.\u201d He\u2019s a lawyer.<\/p>\n

Breaches are an affront to decades of innovation and research. Breaches are an affront to ethics, customer support, and trust. Breaches are an affront to shareholders and those who depended on Equifax for, arguably, a ridiculous service in these days of trust-less networks and powerful data mining tools.<\/p>\n

Add in a clearly inept team at, we assume, Edelman,<\/a> and you have a perfect storm of corporate idiocy. Look at this:<\/p>\n

Yesterday I tried Equifax\u2019s \u201csecurity checker\u201d\/Wordpress instance yesterday, September 8. It said:<\/p>\n

\"\"<\/p>\n

Apparently, however, you could type in Booger\/123456 and get the same answer. Now, thanks to what we can assume was some interference by Equifax\u2019s legal department, nobody is affected, not even Booger.<\/p>\n

\"\"<\/p>\n

That\u2019s right: it went from \u201cYeah, you\u2019re definitely probably hacked\u201d to \u201cNo, you\u2019re probably not hacked\u201d overnight. This tool should be burnt down.<\/p>\n

In short, Equifax can\u2019t protect your data, can\u2019t build a website, and can\u2019t get its story straight. And this is a publicly-traded company with a century of tradition and trust behind it.<\/p>\n

Why am I so angry at this? Imagine John Kelley III had a box of family photos. He sent those family photos to a service for digitization. Those photos included tender moments, pictures loved ones dead and gone, and snaps joyous occasions. There\u2019s ap picture there of him passing the bar, of getting married, of saying goodbye to his father. This photo digitization service did the job \u2013 poorly, to be clear, because we\u2019re equating it to Equifax \u2013 and then threw the box of photos with full identifying information onto the street. John Kelley\u2019s grandmother\u2019s photo was used to create a fake ID. John Kelley\u2019s birthday party pic was posted to Facebook and someone figured out his birthdate or some other piece of trivial information and opened a credit card in his name. Trolls found a picture of his car, deduced its location, and cut the brake lines. The list of offenses can go on ad nauseam.<\/p>\n

Now imagine the same thing is happening to you. Almost monthly your family photos, your birth certificate, and your diary are being ransacked or nearly ransacked by criminals. Your valuables are being broadcast to those who would like to steal them. Imagine that the companies you trust with your health, wealth, and privacy are leaking your information almost daily and that the tools used to secure that data are infuriatingly easy to crack as possible. You\u2019d be mad as hell and you wouldn\u2019t take it anymore.<\/p>\n

But you aren\u2019t. And you do.<\/p>\n

Until John Kelley III is held accountable, until everyone who leaks our data and uses weak tools and methods to secure our data is out of a job, we will not be safe. Sure, many of us have little to hide but it is our right to nonetheless hide what little we do have. Corporate security talks a big game but fails every time. That has to change.<\/p>\n

<\/p>\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunchIt\/~3\/Ijgf1mTQYBQ\/<\/p>","protected":false},"excerpt":{"rendered":"

At this point in the game there should be a single page on every corporate website, preferably accessible from its front page, that includes the name and all contact details <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[19],"tags":[25],"class_list":["post-9108","post","type-post","status-publish","format-standard","hentry","category-enterprise-software","tag-enterprise"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t