Possibly because Equifax's Chief Security Officer (CSO) might not be the best fit for the job. Here's their LinkedIn profile: https://imgur.com/a/dkjzD
Equifax security freeze PINs are the timestamp of when you request the freeze
111–120 of 193 posts
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#112Possibly because Equifax's Chief Security Officer (CSO) might not be the best fit for the job. Here's their LinkedIn profile: https://imgur.com/a/dkjzD
This isn't okay. Don't dox this guy.
Besides, lots of "hacker" hackers are self-taught.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#113It's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance). Doctors, lawyers, and many other professions have such system, why can't we have it as well?
The sheer scale is incomparable. Comparing a doctor's mistake during a surgery doesn't quite compare to losing the data of 147 million. "Critical systems" developers would need astronomically expensive insurance to even exist, and therefore prohibitively high salaries. I personally believe there should be some measure of a corporate death penalty to emphasize the responsibility involved though.
If the risk to such a thing failing is so large, this seems a point against your argument. We MUST be able to reduce the risk of such systems failing, and do so provably. If we cannot reduce the cost, we must reduce the risk, such that the calculation makes the system affordable again.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#114Earlier quoted context omitted.
"Critical systems" pretty vague, and could be used to describe any system that processes payments or other basic things we use. It's fundamentally different from malpractice in my opinion. In health care malpractice has obvious pieces of data - we know who the doctor is, we know their credentials, we know what information they had and when they had it, we know what they decided, what they prescribed, what they said.…
Real engineers have a system in place for this. It's called "Professional Engineer" and it's managed by NCEES. There is no possible reason that practice cannot directly apply to software engineering, except for the cultural refusal of software engineers to take responsibility for anything.
I agree in part, but I think there are a few things about this scenario that highlight the problems with software. First is its extreme mutability: you can endlessly patch it, and often have to when vulnerabilities or flaws are discovered. Unfortunately this tends to lower the bar for a first release. Second, if you want to be cost-effective you must leverage many existing components of mostly unknown providence and quality. Finally the security aspect is extremely difficult because both the cost and risk of mounting an attack are extremely low.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#115Earlier quoted context omitted.
Real engineers have a system in place for this. It's called "Professional Engineer" and it's managed by NCEES. There is no possible reason that practice cannot directly apply to software engineering, except for the cultural refusal of software engineers to take responsibility for anything.
While I agree, how do you apply software engineering practices in a field where a good chunk of the workforce doesn't have formal computer science education?
Even if the whole workforce had formal computer science degrees, most of us still wouldn't have formal engineering education. The CS programs turn out computer scientists, not professional engineers.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#116Earlier quoted context omitted.
>Who exactly is responsible for unrecognized vulnerabilities? Everyone? No one? One dude who everyone sorta thought handled security stuff? It's as clear as mud. Security team with people who do it full time. Betting your security on the one dude who sorta did everything should be criminal. Aka, not this: http://i.imgur.com/a7S95nG.jpg
What if management doesn't hire a security team? What if management hires incompetent security team?
>What if management doesn't hire a security team?
That's clearly negligence.
>What if management hires incompetent security team?
That's harder to do because you have to establish competence, which has led to a bunch of hazing rituals via whiteboard for general software development and a lot of other insecurities. Being a security professional isn't regulated by law, so you can't check the law to determine if someone's competent. So who's opinion do you trust, and why do you trust their competence? An expert witness, maybe?
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#117AMA request: the developer who made this decision. 1. How does it feel to be literally the dumbest engineer on the planet?
Please don't.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#118Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#119It's time to have a mandatory certification for people who develop critical systems. After such certification, you can consider such an implementation a malpractice, and sue them for it (of course the penalty is paid by the insurance company which sold the malpractice insurance). Doctors, lawyers, and many other professions have such system, why can't we have it as well?
The sheer scale is incomparable. Comparing a doctor's mistake during a surgery doesn't quite compare to losing the data of 147 million. "Critical systems" developers would need astronomically expensive insurance to even exist, and therefore prohibitively high salaries. I personally believe there should be some measure of a corporate death penalty to emphasize the responsibility involved though.
>The sheer scale is incomparable. Comparing a doctor's mistake during a surgery doesn't quite compare to losing the data of 147 million.
Then, companies shouldn't have such a high concentration of risks in one place.
The problem wouldn't be such a disaster if just SSN wasn't enough to get a loan. For example, if we had a password in addition to SSN (stored in a hashed form), the problem would be much less severe.
Re: Equifax security freeze PINs are the timestamp of when you request the freeze
#120Earlier quoted context omitted.
The sheer scale is incomparable. Comparing a doctor's mistake during a surgery doesn't quite compare to losing the data of 147 million. "Critical systems" developers would need astronomically expensive insurance to even exist, and therefore prohibitively high salaries. I personally believe there should be some measure of a corporate death penalty to emphasize the responsibility involved though.
If the risk to such a thing failing is so large, this seems a point against your argument. We MUST be able to reduce the risk of such systems failing, and do so provably. If we cannot reduce the cost, we must reduce the risk, such that the calculation makes the system affordable again.
[deleted]