21–30 of 39 posts
Didn't receive an email, but are they just now referring to the incident that took place September 23 2020? https://www.cbc.ca/news/business/shopify-data-breach-1.57351...
I'm pretty sure that at exactly this moment somewhere someone criminal is already analyzing organization structures, employee profiles, internal security policies and tools of the cloud giants.
The "employee access to customer data isn't protected" sits as unsolved an opportunity canvas/brief in almost every SaaS company. You can get to a fair amount of controls with little to no code and only with process changes (aka SoC and ISO certifications), which is also what SaaS security teams spend quite a bit of time on. There are a fair amount of problems to be solved here.
I mean... its only news because it got out. If you seriously believe companies arent accessing your data its borderline delusional.
If he is a spy/robber, if he is corruptible or threatened... a third party will obtain this copy. For the main culprit this doesn't induce any risk (where is the evidence?). This is absolutely not as with your bank, for example, which cannot really steal money without you taking notice.
How serious people are willing to store confidential data on any rented or hosted server is completely beyond me. Then some of their competitors' proposals are "just a little bit" better than theirs', or seem to have a pretty good grasp on some R&D or customer database.
Many here work on some cloud thing, most are honest and some will be upset by my comment. This is not about you but about rotten fruits in the basket.
It seems like employees are becoming the weakest link in cloud security. If Google will be breached one day, most probably it will happen not because of a technical vulnerability, but due to employee sabotage. I'm pretty sure that at exactly this moment somewhere someone criminal is already analyzing organization structures, employee profiles, internal security policies and tools of the cloud giants.
Facebook warn you when you are hired not to actually do this, because they have auditing systems to watch for it and you will be fired (supposedly) but for people employed by some other agency specifically for the purpose of getting high-value private data out of Facebook, being fired by Facebook for doing so is part of the expected outcome and no big deal.
A well funded agency could easily keep getting people hired at Facebook to get whatever data they want, as often as they want. Facebook is constantly trying to keep their hiring pipelines full and despite the image Facebook likes to portray, it isn't "only the best talent" that gets a job there. There are some very smart, capable people at Facebook, but there are a ton of very mediocre engineers that lucked out in the hiring process, as well. It's really just a numbers game to get in.
I'm sure much the same is true at Google/Twitter/etc.
Earlier quoted context omitted.
> not the result of some sort of technical vulnerability So what then? Did they deceive or coerce somebody?
I reckon it was more about internal employees abusing their permissions and access to customer data and being sloppy when attempting to extract it.
Earlier quoted context omitted.
I reckon it was more about internal employees abusing their permissions and access to customer data and being sloppy when attempting to extract it.
That wouldn't be "without authorization" then.
Let’s say I own a company like Shopify. I have an agreement with my customers: I won’t use consumers’ personal details for anything other than processing orders. Sure, I have the technical authority to poke around in the database if I so desire. I could technically take all that data and sell it to the highest bidder. That doesn’t mean I’m legally or procedurally authorized to do so.
Employees have procedures they are expected to follow. Many employees have significant permissions to access data. It’s unreasonable to bar all employees from accessing sensitive data at a technical level; people need to be able to fix problems when things go wrong. If a group of developers conspire to push malicious or faulty changes to production, including the developers who are supposed to be reviewing code and preventing such things from happening, that doesn’t change the fact that they are not authorized to exfiltrate data.
You can go online and buy a set of keys used by first responders. For $25, you can get into just about any commercial building. Are you authorized to actually use those keys on someone else’s property? Not without a contract, but that doesn’t mean there’s a technical barrier in place.
Let’s talk about Shopify’s datacenters! They probably colocate or use a cloud service or whatever. Ultimately, data is stored in datacenters. Someone like Deviant Ollam will have no trouble waltzing right in the front door. He might already have the keys. Or maybe he colocates at the same datacenter, getting him a good chunk of the way there. Is he legally authorized to access customer data, despite having the tools at his disposal to access it with minimal difficulty and likely no digital hackery? No, he is not.