Allianz Life says 'majority' of customers' personal data stolen in cyberattack

Did you see Google or facebook or Miceosoft customer databases breached ?

The issue is there is too little repercusions for companies making software in shitty ways.

Each data breach should hurt the company approximately to the size of it.

Equifax breach should have collapsed the company. Fines should be in tens of billions of dollars.

Then under such banhammer software would be built correctly, security would becared about, internal audits would be made (real ones) and people would care.

Currently as things stand. There is ZERO reason to care about security.

Do you think we should have strong legal protections for people who go around your neighborhood trying unlocked car doors and opening front doors (with a backpack full of burglary tools) and when confronted claim they're uh doing it for your security?

If companies faced real consequences, like substantial fines from a regulatory body with the authority to assess damage and impose long-term penalties, their stock would take a hit. That alone would compel them to take security seriously. Unfortunately, most still don’t. More often than not, they walk away with a slap on the wrist. If, that.

> I say this often, and it's quite an unpopular idea, and I'm not sure why. > Etc...etc...etc....

Me, neither, if that helps.

  > I say this often, and it's quite an unpopular idea, and I'm not sure why.
  >
  > Security researchers, white-hat hackers, and even grey-hat hackers should have
  > strong legal protections so long as they report any security vulnerabilities
  > that they find.
  >
  > The bad guys are allowed to constantly scan and probe for security
  > vulnerabilities, and there is no system to stop them, but if some good guys
  > try to do the same they are charged with serious felony crimes.

The internet is really a lot like the ocean, things left unmaintained on it are swallowed by waves and sea life.

We need something like the salvage law.

No. You cannot come to my home or business while I'm away and try to break in to protect me unless I ask, full stop. Same goes for my servers and network. It's my responsibility, not anyone else's. We have laws in place already for burgers and hackers. Just because they continue to do it doesn't give anyone else the right to do it for the children or whatever reasoning you come up with.

I mean, the problem is people will break things. How do you responsibly hack your local electric grid? What if you accidentally mess with something you don't understand, and knock a neighborhood out? How do we prove you just responsibly hacked into a system full of private information then didn't actually look at a bunch of it?

> I hate the term stealing identity, because it implies the victim made some mistake to allow it to happen. When what really happened is the company was lazy to verify that the person they're doing business with is actually who they say they are. The onus and liability should be on the company involved.

You may enjoy this sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E

> these endless data breaches could be reduced if we fixed the incentives, but that's difficult

It’s honestly unclear if the damage from data breaches exceeds the cost of eliminating it. The only case where I see that being clear is in respect of national security.

The solution already exists: MFA and IdP federation.

One factor you know (data) and the other you posess, or you are (biometrics).

IdP issues both factors, identification is federated to them.

Kind of happens when you are required to supply driver's license, which technically you own and is federated id if checked in government system, but can be easily forged with knowledge factors alone.

Unfortunately banks and governments here use facial recognition for the second factor, which has big privacy concerns, and the tendency I think will be federal government as sole IdP. Non-biometroc factors might have practical difficulties at scale, but fingerprint would be better than facial. It's already taken in most countries and could be easily federated. Not perfect but better than the alternatives imo.

Unless there is willfull negligence (very difficult to prove) or malicious behavior I don't think putting people in jail will help. Most of this stuff happens by accident not by intent.

Financial consequences to the company might be a deterrent, of course then you're dealing with hundreds or thousands of people potentially unemployed because the company was bankrupted by something as simple as a mistake in a firewall somewhere or an employee falling victim to a social engineering trick.

I think the path is along the lines of admitting that cloud, SaaS and other internet-connected information systems cannot be made safe, and dramatically limiting their use.

Or, admitting that a lot of this information should be of no consequence if it is exposed. Imagine a world where knowing my name, SSN, DOB, address, mother's maiden name, and whatever else didn't mean anything.

Haha, I still vividly remember how they were trying to make me believe that GDPR is going to a big hammer because it will finally make executives liable for breaches. I silently laughed back then. I am still laughing.

I should probably clarify: There are two types of people that climed that back then. Those trying to gaslight us, and those naiv enough to actually believe the gaslighting. Severe negligence has to be proofen, and that is not easy, and there is a lot of wiggle room in court. Executives being liable for what they did during their term is just not coming, sorry kids.

Mandatory amount paid directly to the customer of record, instead of fractions of a cent on the dollar, in year long class action settlements might help the disenfranchised 'customers'.

> Would be company-terminal

What happens to customers of the affected company in this case? Does this not now pass on a second problem to the people actually affected?

Would be national economy terminal too

Insurance is part of the problem - companies prefer to insure themselves rather than employ and support the research and development of secure software. As long as this is the more economical thing to do, nothing will change.

Good to see the contractually required endpoint protection was working.

Another article mentioned Salesforce which has a knack for being poorly secured on the data owners side.

I’ve got another reply here with details but suffice it to say misconfigured Salesforce tenants are all over the internet.

Does it matter? Wasn't a technical breach of their systems, but instead social engineering.

Depending on the CRM, is this not a HIPAA violation?

This isn't an offshore situation though.

I've worked with Allianz's cybersecurity personas previously on EBRs/QBRs, and the issue is they (like a lot of European companies) are basically a confederation of subsidiaries with various independent IT assets and teams, so shadow IT abounds.

They have subsidiaries numbering in the dozens, so there is no way to unify IT norms and standards.

There is an added skills issue as well (most DACH companies I've dealt with have only just started working on building hybrid security posture management - easily a decade behind their American peers), but it is a side effect of the organizational issues.