61–62 of 62 posts
Earlier quoted context omitted.
What if their prepared plan was “no comment“? I think you’re making an unreasonable number of assumptions.
Do you think "no comment" is a good plan, when you've just sent out an emergency email to all of your customers telling them to rotate any credentials they entrusted to you?
Earlier quoted context omitted.
It was probably an encrypted bucket, and the AWS keys had access to read/decrypt. Encryption is easy. Meaningful key management is hard.
Yeah, this caught my eye: > “If they are hosting customer data on a third-party system like Amazon, it better damn well be encrypted,” Weaver said. “If they are telling people to rest credentials, that means it was not encrypted. So mistake number one is leaving Amazon credentials in your Git archive. Mistake number two is using S3 without using encryption on top of it. The former is bad but forgivable, but the latte…
The way I see it -- what I want to protect against is an attacker being able to slurp up all of my online, potentially accessible protected data, while at the same time, I generally want to access it for legitimate purposes. And that's difficult -- so what we wind up doing is making it expensive/time consuming/audited to access the protected data.