Panerabread.com leaks millions of customer records

Post by sli » Tue, Apr 03, 2018, 3:17 PM UTC

UberBoll wrote: post #129

mr_overalls wrote: post #122

Earlier quoted context omitted.

"...demanding a PGP key" This kind of incompetence directly endangers the privacy and security of anyone who does business with Panera. And it's reminiscent of the kind of incompetence that characterized the Equifax breach and other recent high-profile hacks. Maybe it's time that a subset of IT workers become professionally licensed and liable, like engineers.

>it's reminiscent of the kind of incompetence that characterized the Equifax breach Go to Mike's LinkedIn and he is the former "ISO - Sr. Director of Security Operations" for Equifax.

Post by tedunangst » Tue, Apr 03, 2018, 3:35 PM UTC

smileysteve wrote: post #97

tptacek wrote: post #62

Earlier quoted context omitted.

What if the CSO informed engineering teams, got stonewalled, and, a few weeks later, escalated through the company's risk process (Panera is public, or was before it was bought by a public company, and will have a risk process). What do people here think a CSO does? If your mental model is: "decree that something is safe to deploy publicly, or else forbid its deployment", your model is broken. Most CSOs have an advis…

Pull the plug. The final "stick" and reason for a C in the title is the responsibility to shut down the data (and website) until such a point it can be secured. It's should be considered more of a fiduciary duty (protect shareholders, customers) to protect data as making the right investment or HR decisions.

Post by tptacek » Tue, Apr 03, 2018, 4:08 PM UTC

smileysteve wrote: post #97

tptacek wrote: post #62

Earlier quoted context omitted.

What if the CSO informed engineering teams, got stonewalled, and, a few weeks later, escalated through the company's risk process (Panera is public, or was before it was bought by a public company, and will have a risk process). What do people here think a CSO does? If your mental model is: "decree that something is safe to deploy publicly, or else forbid its deployment", your model is broken. Most CSOs have an advis…

Pull the plug. The final "stick" and reason for a C in the title is the responsibility to shut down the data (and website) until such a point it can be secured. It's should be considered more of a fiduciary duty (protect shareholders, customers) to protect data as making the right investment or HR decisions.

Post by FRex » Tue, Apr 03, 2018, 4:12 PM UTC

mr_overalls wrote: post #122

crescentfresh wrote: post #120

Good read outlining the timeline of events from the person who originally reported the leak: https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-s... I found his initial interaction with their head of IT Security (very first initial response) laughably appalling: Dylan Houlihan to Mike, Geri Haight - Hello Mike et al, Thank you for making yourselves available. There is a security vulnerability on the delivery.…

"...demanding a PGP key" This kind of incompetence directly endangers the privacy and security of anyone who does business with Panera. And it's reminiscent of the kind of incompetence that characterized the Equifax breach and other recent high-profile hacks. Maybe it's time that a subset of IT workers become professionally licensed and liable, like engineers.

Post by CWuestefeld » Tue, Apr 03, 2018, 4:21 PM UTC

lsaferite wrote: post #116

CWuestefeld wrote: post #108

Earlier quoted context omitted.

Even storing complete cards numbers is only allowed under very specific conditions. We encrypt these at the app, even before putting them into the DB, yada yada. The PCI auditor actually made us restore the DB from backup onto another server and show them the data, to prove that some magical process in the backup program didn't cause them to come un-encrypted. They also wanted us to change all corporate email address…

I find PCI compliance annoying mostly due to individual auditor predilections.