11–20 of 37 posts
Earlier quoted context omitted.
I'm sure there are lots of people paid to not work simply because of what they know
Close, but not quite how it works - there's actually a series of documentaries about the practice of retiring spies called The Prisoner. https://en.wikipedia.org/wiki/The_Prisoner
Let's see some independent analyses of this dataset. Start turning on the right lights and the roaches will scatter.
Well if Google Reviews are anything to go by, McDonalds is more pleasant than working at/with TigerSwan. Also, it's amusing that they're blaming this mysterious third-party "TalentPen" whose search results are so scant that they have this very article as one of the top hits. Wouldn't TigerSwan be equally liable for vetting their vendors?
Though it's no excuse, it's not surprising people leave it open, it's too hard to figure out how to lock it down.
Amazon needs to share some of the blame here and create a sane UI.
Time Warner Cable also had the same data breach. I wonder by passwordless did they mean someone was able to do a ls command on the bucket and was able to download as a public/anon user (direct s3 link)? If this was done I bet you someone probably didn't have time to implement secure link, just decided to make the bucket open.
Setting permissions on s3 buckets is absurdly complicated. Though it's no excuse, it's not surprising people leave it open, it's too hard to figure out how to lock it down. Amazon needs to share some of the blame here and create a sane UI.
Time Warner Cable also had the same data breach. I wonder by passwordless did they mean someone was able to do a ls command on the bucket and was able to download as a public/anon user (direct s3 link)? If this was done I bet you someone probably didn't have time to implement secure link, just decided to make the bucket open.
That sounds more likely. AWS permissions are tricky, but not so tricky that it's easy to leave a bucket wide open like that. In my experience, they're much more likely to lock out someone who should be able to access them than to allow someone who shouldn't. Just bad practice to give up and allow anyone in.
Putting top secret anything on the Internet seems like the opposite of a good idea.
4 million people have top secret clearance. what is and isn't a good idea given this state of affairs is ummm... [1] https://www.washingtonpost.com/news/worldviews/wp/2013/06/12...
Setting permissions on s3 buckets is absurdly complicated. Though it's no excuse, it's not surprising people leave it open, it's too hard to figure out how to lock it down. Amazon needs to share some of the blame here and create a sane UI.
Default settings are usually NO public read, and it actually takes more work to make stuff publicly readable on S3 than to just leave it as private.
I am thinking the biggest stuff up with this vendor is that they made the entire bucket or bucket key available publicly, which is a pretty dumb, and deliberate thing.
If you wanted people to access resumes on an individual basis via a known web link, then just make the documents individually publicly readable, but don't make the entire bucket readable by default.
Better still, use Amazon's 'one time' or time based permissions to make sensitive files only available to a certain person or for a limited time.
Re: UI - Amazons new S3 console is spades better than their old one - plenty of auditing and analytics tools there too which can prevent silly mistakes like this.