Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Colossal, Monumental Screw Up That Is Marriott Security

danmunro.com

Post reply on HN
Print view View original

21–30 of 38 posts

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#21

Post by jacques_chester »

number-sequence wrote: post #7
jeanvaljean2463 wrote: post #5

Disclaimer: Not defending Marriott, as their Starwood Rewards/Marriott Rewards merger has been demonstrably one of the most epic, public IT integration failures that I've ever personally witnessed as a consumer bystander. BLUF: I am a huge advocate of companies being fined on the basis of number of people affected and types of data leaked. This incentive to not be fined will be built into the formal or informal risk…

I agree with the idea that fines based on the number of users affected makes a lot of sense. One question I have is how would you propose that number be calculated? In truth, I think the company whose data has been leaked should know exactly how many records have been leaked, but per-individual based fines create an incentive for them to underreport this number. Do you think that’s a problem, and if so, is there a go…

> One question I have is how would you propose that number be calculated?

As a percentage of worldwide revenue on a sliding scale.

> In truth, I think the company whose data has been leaked should know exactly how many records have been leaked, but per-individual based fines create an incentive for them to underreport this number.

Very true, so triple damages for wilful underreporting and/or criminal sanctions for individuals.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#22

Post by WillPostForFood »

wavefunction wrote: post #3
coldcode wrote: post #2

Pays to read the original article, it wasn't Marriott it was the company they bought, long before the purchase. Marriott's system was not compromised.

When they bought that company it became their system. You can't just hand wave away PCI compliance hehe.

It just might be a more accurate if it was something like, “Marriott bought itself a security nightmare with the Starwood acquisition.” It is certainly Marriott’s problem to deal with now, but there security team might not be as bad as Starwood’s.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#23

Post by fefe23 »

This article proposes buzzword-level security theater. IDS! Rotate certificates and credentials! Have pentests!!

What it fails to mention is: Do not collect data you do not need. You do not need my email. Forcing me to give it to you is bad. You do not need to know my home address. Forcing me to give it to you is bad. You do not need to know my birthday. Forcing me to give it to you is bad. etc pp. The mind boggles why they thought they need to collect passport data!

IDS and certificate rotation are snake oil and security theater. Sure, they usually don't hurt. But here is some good advice:

1. Don't collect the data. If you don't have it, it can't be stolen.

2. Apply all the patches. Immediately. No you don't know better than the vendor. Install all of them. Always. Immediately.

3. No unnecessary dependencies. Yes that means don't go in the cloud.

4. Have an architecture that segregates stuff by security level. Don't put all your things in the same basket unless you are prepared to have the highest security level for all of them. No "this is just a chat server, it is less important than the database" unless those are properly isolated.

5. Minimize your TCB. The less things you have to trust, the better.

And THEN, after all this is done, can we talk about IDS and certificate rotation.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#24

Post by jcrawfordor »

The way this article talks about IDS sounds, to me, like someone who has never worked with IDS professionally or on any large scale. This goes for other points in the article as well, but that seemed particularly glaring.

I don't intend to defend Marriot, from other coverage it sounds like someone did a very poor job (although not necessarily Marriot itself). But this article also makes things sound far simpler than they are.

My best guess is that the attacker gained access to a database server, and let's say they dumped the contents to a file and exfil'd the file (not always the best way to go, but often the best way to go). Assuming they stole database creds from somewhere else (e.g. some application), that might generate around a half dozen auditable log items on the database server. The retrieval of a large file would be a good opportunity for detection by SIEM content, but without further knowledge of the application it might not be - large file transfers from that machine might be normal as part of e.g. batch processing.

For me, it's hard to say at this point that this would have been easy to catch at all. Perhaps it would have been, but if the attacker was some combination of competent and lucky (combined with the lack of measures like limiting database access rate for applications, which are quite rare in practice), they may have been in and out with very little detectable activity.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#25

Post by watertom »

I'm an Information Security and Privacy professional, and until there are real penalties for a lack of security nothing will change.

Go see the Ford Pinto case, cheaper to pay lawsuits from deaths than fix the problem, then don't fix the problem.

The other problem is an utter and total lack of technical knowledge by Sr. Management, they hire charming idiots who tell Sr. Management what they want to hear. I've been to conferences and I've listened to discussions from "security professionals" and I'd swear I was at my local supermarket asking people about Information Security and Privacy.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#26

Post by ramses0 »

fefe23 wrote: post #23

This article proposes buzzword-level security theater. IDS! Rotate certificates and credentials! Have pentests!! What it fails to mention is: Do not collect data you do not need. You do not need my email. Forcing me to give it to you is bad. You do not need to know my home address. Forcing me to give it to you is bad. You do not need to know my birthday. Forcing me to give it to you is bad. etc pp. The mind boggles w…

The same way you can throw snark at a company for their (lack of) security knowledge, they can do the same for your lack of industry knowledge.

Generally, gathering passport data for hoteliers is a legal requirement (see here: https://www.quora.com/Why-do-some-countries-require-a-passpo... ).

Now. Agreed. Required to collect v. having available online and hackable for all guests ever is not a best practice, but it's easy to see how a hotel (quite physical-space-intensive, labor-intensive, capital-intensive business) may not have viewed or understood the risks of having this data around.

The last time I stayed in a hotel, there was a car whose window was broken in the parking lot (unfortunately). A crime was committed, on hotel property!

The question businesses are struggling with is: how can they focus on their business and either government or industry can focus on crime-prevention?

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#27

Post by fefe23 »

ramses0 wrote: post #26
fefe23 wrote: post #23

This article proposes buzzword-level security theater. IDS! Rotate certificates and credentials! Have pentests!! What it fails to mention is: Do not collect data you do not need. You do not need my email. Forcing me to give it to you is bad. You do not need to know my home address. Forcing me to give it to you is bad. You do not need to know my birthday. Forcing me to give it to you is bad. etc pp. The mind boggles w…

The same way you can throw snark at a company for their (lack of) security knowledge, they can do the same for your lack of industry knowledge. Generally, gathering passport data for hoteliers is a legal requirement (see here: https://www.quora.com/Why-do-some-countries-require-a-passpo... ). Now. Agreed. Required to collect v. having available online and hackable for all guests ever is not a best practice, but it's…

I am aware of legal requirements for hotels.

Here's my technical view:

That does not mean you have to _have_ the data. Either forward the customer to a government system where they enter the data, then it's the government's fault. Or do escrow: For example, you could store the data encrypted with a public key of the government. Then only they could decrypt it. If someone stole it, there would be no problem. And the government could still view the data.

My political view is that the government has no business asking hotels to collect passport data, or indeed any data on their customers. This is a blatant privacy and data protection violation. The government does not need to know my location at all times. It's deplorable that things have deteriorated this far already.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#28

Post by inetknght »

joncrane wrote: post #12
ejcx wrote: post #6

I'm sure Marriot had an IDS that created 10000+ alerts per day. I'm sure they also had a credential rotation policy, hired 3rd party pentesters, had a vulnerability management program, etc Securing systems is really hard. A lot of the old school recommendations create more issues than they solve, like rotating every database login password every 90 days or so.

>A lot of the old school recommendations create more issues than they solve, like rotating every database login password every 90 days or so. This is one of the ones that drives me crazy. You can maybe make it work if you have a really good secrets management system, especially if it's hooked into AWS EC2 roles. But having to manually log into servers to change config files/passwords every 90 days is ridiculously dis…

> having to manually log into servers to change config files/passwords every 90 days is ridiculously disruptive

Then make it so you don't have to manually log into servers to change files/passwords.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#29

Post by sol_invictus »

a2tech wrote: post #18

This article is useless. It says nothing, has no information on what or how the breach happened, and is basically security word salad with a heaping of 'these people are idiots'.

Yeah, I'm fairly sure one of the first news pieces on the attack literally said the security team discovered the breach when "alerted by suspicious activity on their customer database" - sounds a lot like an IDS functionality.

Re: The Colossal, Monumental Screw Up That Is Marriott Security

#30

Post by tomatotomato37 »

coldcode wrote: post #2

Pays to read the original article, it wasn't Marriott it was the company they bought, long before the purchase. Marriott's system was not compromised.

That is exactly what due diligence is for. At the very least the potential of this happening should have been priced into the final purchasing cost
Post reply on HN