First American Financial Corp. Leaked Hundreds of Millions of Insurance Records • Hacker News Board

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#121

Post by toong » Sat, May 25, 2019, 5:50 AM UTC

zhte415 wrote: post #114

A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest int…

And this is from a huge organisation. There are many more medium-large organisations that still operate under the Chinese-walls model: perimeter defense, but once you are inside the VPN/intranet the security is a lot more relaxed (if any). That is the security culture and very hard to change.

The market forces those orgs to start offer services online. They run those (relaxed security) services inside their intranet, so they start poking holes in their firewall. The next decade is not going to be pretty in that regard.

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#122

Post by skunkworker » Sat, May 25, 2019, 5:57 AM UTC

skrebbel wrote: post #120

bloopernova wrote: post #41

Earlier quoted context omitted.

I'm currently fighting against management dragging their feet on using 2FA. On HIPAA PHI. (I know HIPAA doesn't actually mandate 2FA, but it's recommended by many best practices and guides.) Apparently some tech folks don't like the inconvenience of 2FA.

2FA freaks me out. It means I'll be locked out of all my key accounts and services if ever my phone breaks or gets lost. Probably right when I need these services most.

That’s why they usually have backup keys that you physically keep in a safe place.

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#123

Post by snovv_crash » Sat, May 25, 2019, 6:16 AM UTC

jacquesm wrote: post #27

snovv_crash wrote: post #13

At some point people will realise that holding large quantities of sensitive information is a liability, not an asset. Mindsets are slowly changing in this direction already. The chickens will continue to come home to roost until people treat digital security as seriously as physical security.

> At some point people will realise that holding large quantities of sensitive information is a liability, not an asset. That's my line :): "It forces you to think about data as a liability, rather than an asset and that particular mindset is a good one to have when you are dealing with end user data." https://jacquesmattheij.com/gdpr-hysteria-part-ii-nuts-and-b... It stood the test of time rather well. Now we see a…

I hadn't actually read your GDPR series, thanks!

Absolutely agree, and to further it I think this data liability goes beyond PII. Any data which could be used nefariously if publicly available is a potential liability if leaked - NDA'd documents, product roadmaps, source code of closed source software, private keys, pre-results earnings, the list is enormous.

With the shift in the economy from physical goods to IP I don't see why laws for physical goods storage, warehousing and safekeeping (eg. safety deposit boxes) won't be updated to include the digital equivalents in the not too distant future. And at that point I wouldn't want to be a Dropbox, EC2 or DigitalOcean unless I was very very sure of my security systems, never mind being a Facebook or Google.

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#124

Post by zhte415 » Sat, May 25, 2019, 6:16 AM UTC

toong wrote: post #121

zhte415 wrote: post #114

A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest int…

And this is from a huge organisation. There are many more medium-large organisations that still operate under the Chinese-walls model: perimeter defense, but once you are inside the VPN/intranet the security is a lot more relaxed (if any). That is the security culture and very hard to change. The market forces those orgs to start offer services online. They run those (relaxed security) services inside their intranet,…

I think you're correct, that these will become more common. A couple of years ago I was chatting with friends who were doing APIs, because of market/regulatory pressure EU's PSD2, exporting JSON of transactions using COBOL for use in online. Because that bank - almost an order of magnitude larger than First American in terms of employees - will do everything in order to not move off COBOL / it's legacy system.

Interesting skill set: COBOL, DB2, JS, Angular.

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#125

Post by jordanbeiber » Sat, May 25, 2019, 6:31 AM UTC

zhte415 wrote: post #114

A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest int…

Is not the tech a part of the organizations way of doing business?

These things are highly related to what’s going down in a thread [1] from yesterday (about “shitty projects”).

I’m sure these guys spend many millions each year on security products, but either people in the know on the tech side is ignored, or they have no competencies left.

In the thread I mention above I have actually posted about my general experience from a major insurance player.

A concrete example:

We were making changes to a custom software and as there were concerns about bandwidth requirements and latency I took it upon myself to figure out what a specific process looked like, from the business perspective.

In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it...

This was in the time when a lot of these “lost usb devices” and hacked systems seemed to pop up daily.

I obviously raised this with the security team, the security officer and the business unit.

No one wanted to touch this finely tuned business process.

It felt like I was working at fawlty towers.

Again, that companies have drawn this line between business and tech, “‘cause tech is not core bidniz”, will haunt a lot of big players for years to come.

[1] https://news.ycombinator.com/item?id=19998806

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#126

Post by sverhagen » Sat, May 25, 2019, 7:37 AM UTC

tptacek wrote: post #91

sverhagen wrote: post #85

Earlier quoted context omitted.

On average: yes. Always: no.

Always no? What's a situation in which you'd be better off with monotonic ids?

I never said they were less secure. I said there are situations where they're not really more secure.

If I can see in this HTML page that your reply is /reply?id=12345, then it doesn't matter if Hacker News uses integers or UUIDs, if there's a bug in /edit?id=12345 that just lets me edit it without the appropriate security. If we say that UUIDs always make everything inherently more secure, we're doing everyone a disservice.

Now, the original discussion was about (1) discovering for read, and not about (2) escalating a read to a write. But if anyone reading this mistakenly takes from it that UUIDs are the way to solve these problems then they will go on optimizing for (1) at the expense of (2).

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#127

Post by jacquesm » Sat, May 25, 2019, 7:42 AM UTC

vonmoltke wrote: post #30

jacquesm wrote: post #27

Earlier quoted context omitted.

> At some point people will realise that holding large quantities of sensitive information is a liability, not an asset. That's my line :): "It forces you to think about data as a liability, rather than an asset and that particular mindset is a good one to have when you are dealing with end user data." https://jacquesmattheij.com/gdpr-hysteria-part-ii-nuts-and-b... It stood the test of time rather well. Now we see a…

This company is dealing in financial transaction data. Someone needs to hold it, and it can be deleted (especially when someone asks for it). I don't see how this particular situation advances your position.

For one they could split it into 'hot' data and 'cold' data that needs to be stored for legal and compliance reasons but that does not necessarily need to be part of the live set. That strategy alone would seriously limit the impact of a lot of these breaches.

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#128

Post by jacquesm » Sat, May 25, 2019, 7:44 AM UTC

snovv_crash wrote: post #123

jacquesm wrote: post #27

Earlier quoted context omitted.

> At some point people will realise that holding large quantities of sensitive information is a liability, not an asset. That's my line :): "It forces you to think about data as a liability, rather than an asset and that particular mindset is a good one to have when you are dealing with end user data." https://jacquesmattheij.com/gdpr-hysteria-part-ii-nuts-and-b... It stood the test of time rather well. Now we see a…

I hadn't actually read your GDPR series, thanks! Absolutely agree, and to further it I think this data liability goes beyond PII. Any data which could be used nefariously if publicly available is a potential liability if leaked - NDA'd documents, product roadmaps, source code of closed source software, private keys, pre-results earnings, the list is enormous. With the shift in the economy from physical goods to IP I…

Having a good definition of the data life-cycle is a very important step. A lot of companies only do CRU but forget about the D because they feel that more data is more value. As you correctly infer at some point in time the value of the data no longer outweighs the liability and it should be deleted, and long before that it should probably be moved to a much harder to reach system that contains historical data.

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#129

Post by skrebbel » Sat, May 25, 2019, 8:13 AM UTC

skunkworker wrote: post #122

skrebbel wrote: post #120

Earlier quoted context omitted.

2FA freaks me out. It means I'll be locked out of all my key accounts and services if ever my phone breaks or gets lost. Probably right when I need these services most.

That’s why they usually have backup keys that you physically keep in a safe place.

That sounds decent but I've not seen this a lot. Its often just "give us your phone number and we'll SMS you an access key when you log in"

Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

#130

Post by zhte415 » Sat, May 25, 2019, 8:17 AM UTC

jordanbeiber wrote: post #125

zhte415 wrote: post #114

A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest int…

Is not the tech a part of the organizations way of doing business? These things are highly related to what’s going down in a thread [1] from yesterday (about “shitty projects”). I’m sure these guys spend many millions each year on security products, but either people in the know on the tech side is ignored, or they have no competencies left. In the thread I mention above I have actually posted about my general experi…

> In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it...

That's a manually initiated transaction done internally and should be a red flag to anyone. Data outside of the organisation is data with no control. You could keep escalating this. That's an example of no 'speaking up' channel. If a channel to escalate is missing or poorly implemented, frauds will happen by internal or external agents. The process doesn't sound finely tuned at all.