What's "M & M Security"? Linked article never defines the "M"s, I had no luck googling.
It's linked, and it's perimeter based security. I've also known it as egg-based security - once the shell breaks, you've got a big mess on your hands.
The Colossal, Monumental Screw Up That Is Marriott Security
11–20 of 38 posts
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#12I'm sure Marriot had an IDS that created 10000+ alerts per day. I'm sure they also had a credential rotation policy, hired 3rd party pentesters, had a vulnerability management program, etc Securing systems is really hard. A lot of the old school recommendations create more issues than they solve, like rotating every database login password every 90 days or so.
>A lot of the old school recommendations create more issues than they solve, like rotating every database login password every 90 days or so.
This is one of the ones that drives me crazy. You can maybe make it work if you have a really good secrets management system, especially if it's hooked into AWS EC2 roles. But having to manually log into servers to change config files/passwords every 90 days is ridiculously disruptive.
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#13Disclaimer: Not defending Marriott, as their Starwood Rewards/Marriott Rewards merger has been demonstrably one of the most epic, public IT integration failures that I've ever personally witnessed as a consumer bystander. BLUF: I am a huge advocate of companies being fined on the basis of number of people affected and types of data leaked. This incentive to not be fined will be built into the formal or informal risk…
I agree with the idea that fines based on the number of users affected makes a lot of sense. One question I have is how would you propose that number be calculated? In truth, I think the company whose data has been leaked should know exactly how many records have been leaked, but per-individual based fines create an incentive for them to underreport this number. Do you think that’s a problem, and if so, is there a go…
Idea: Create an incentive to overestimate — if the leaked data shows up online (pastebin/etc), and the volume of affected users is x% greater than the publicly disclosed figure, then fines are doubled (or go up by 3*x% or whatever).
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#14Disclaimer: Not defending Marriott, as their Starwood Rewards/Marriott Rewards merger has been demonstrably one of the most epic, public IT integration failures that I've ever personally witnessed as a consumer bystander. BLUF: I am a huge advocate of companies being fined on the basis of number of people affected and types of data leaked. This incentive to not be fined will be built into the formal or informal risk…
When we’re talking about the payment card data that was exposed, I thought there was a mechanism to charge companies on risk. My understanding of PCI DSS is that you have regular audits, and if you fail those, the cost charged by card companies goes up.
IME, you can get away with quite a lot during the audit. You don’t have to be perfect, you just have to have a plan to fix what was found. I would guess that breached app was incorrectly classified as not in scope. PCI audits suck, and so there’s a huge incentive to classify your app/system as not in scope.
Do agree that the fine structure is what will get action. GDPR has raised the interest of making some improvements in how PII is managed.
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#15What's "M & M Security"? Linked article never defines the "M"s, I had no luck googling.
An M&M is a type of candy popular in the US with a hard outer shell and a softer interior. The author is using it metaphorically.
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#16I'm sure Marriot had an IDS that created 10000+ alerts per day. I'm sure they also had a credential rotation policy, hired 3rd party pentesters, had a vulnerability management program, etc Securing systems is really hard. A lot of the old school recommendations create more issues than they solve, like rotating every database login password every 90 days or so.
> I'm sure they also had a credential rotation policy, hired 3rd party pentesters, had a vulnerability management program, etc
Why are you so sure? The vast majority of the companies out there is terribly sloppy when it comes to security and does not have any of those. I doubt the effectiveness of credential rotation by the way, that's mostly outdated advice.
Six letter passwords without any complexity requirements are still pretty common ('123456'), as is unsalted MD5 for password hashes, IDS is a term that usually requires explanation and if there has been a 3rd party pentest it usually was long ago.
Some industries are better than other (fintech, medical), but there too you find terrible examples.
I look at another company every week and the state of security at most of them is usually fairly bad with a few exceptions where things are mostly in order. Note that we do not do a security audit, this is just a general look at company affairs and security is only a very small part, just enough to tell whether or not they take it serious or not and how big the risk of an embarrassing hack is, and what the damage would be if one took place.
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#17Re: The Colossal, Monumental Screw Up That Is Marriott Security
#18This article is useless. It says nothing, has no information on what or how the breach happened, and is basically security word salad with a heaping of 'these people are idiots'.
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#19Disclaimer: Not defending Marriott, as their Starwood Rewards/Marriott Rewards merger has been demonstrably one of the most epic, public IT integration failures that I've ever personally witnessed as a consumer bystander. BLUF: I am a huge advocate of companies being fined on the basis of number of people affected and types of data leaked. This incentive to not be fined will be built into the formal or informal risk…
I agree with the idea that fines based on the number of users affected makes a lot of sense. One question I have is how would you propose that number be calculated? In truth, I think the company whose data has been leaked should know exactly how many records have been leaked, but per-individual based fines create an incentive for them to underreport this number. Do you think that’s a problem, and if so, is there a go…
We might already have an example in HIPAA.
Re: The Colossal, Monumental Screw Up That Is Marriott Security
#20Disclaimer: Not defending Marriott, as their Starwood Rewards/Marriott Rewards merger has been demonstrably one of the most epic, public IT integration failures that I've ever personally witnessed as a consumer bystander. BLUF: I am a huge advocate of companies being fined on the basis of number of people affected and types of data leaked. This incentive to not be fined will be built into the formal or informal risk…
Australia has the "Notifiable Data Breaches Scheme" under its Privacy Act, which requires breaches to be reported to the government[0].
It doesn't have an investigatory/corrective framework like the NTSB (in Australia, the ATSB), but it's the first step towards one.
Australian policy on technology and civil liberties has generally been very poor in the past 2 decades, but the Privacy Act and surrounding policies have been one of the few bright points.
https://www.oaic.gov.au/privacy-law/privacy-act/notifiable-d...