breaches
It’s Not The Crime, It’s The Coverup or the Chaos
Well, Richard Smith has “resigned” from Equifax. The CEO being fired is a rare outcome of a breach, and so I want to discuss what’s going on and put it into context, which includes the failures at DHS, and Deloitte breach. Also, I aim to follow the advice to praise specifically and criticize in general,…
Read More It’s Not The Crime, It’s The Coverup or the ChaosBreach Vouchers & Equifax 2017 Breach Links
Post thumbnail
[Thursday, September 21th is the latest of 5 updates.] When I wrote “The Breach Response Market Is Broken,” I didn’t expect one of the players to validate everything I had to say. What I said was that the very act of firms contracting with breach response services inhibit the creation of a market for breach…
Read More Breach Vouchers & Equifax 2017 Breach LinksYahoo! Yippee? What to Do?
[Dec 20 update: The first draft of this post ended up with both consumer and enterprise advice, which made it complex. The enterprise half is now on the IANS blog: Never Waste a Good Crisis: Yahoo Edition.] Yesterday, Yahoo disclosed that attackers broke into Yahoo in 2013 and stole details on a billion accounts. Brian…
Read More Yahoo! Yippee? What to Do?The Breach Response Market Is Broken (and what could be done)
Much of what Andrew and I wrote about in the New School has come to pass. Disclosing breaches is no longer as scary, nor as shocking, as it was. But one thing we expected to happen was the emergence of a robust market of services for breach victims. That’s not happened, and I’ve been thinking…
Read More The Breach Response Market Is Broken (and what could be done)Threat Modeling Crypto Back Doors
Today, the Open Technology Institute released an open letter to the President of the United States from a broad set of organizations and experts, and I’m pleased to be a signer, and agree wholeheartedly with the text of the letter. (Some press coverage.) I did want to pile on with an excerpt from chapter 9…
Read More Threat Modeling Crypto Back DoorsThe Onion and Breach Disclosure
There’s an important and interesting new breach disclosure that came out yesterdau. It demonstrates leadership by clearly explaining what happened and offering up lessons learned. In particular: It shows the actual phishing emails It talks about how the attackers persisted their takeover by sending a fake “reset your password” email (more on this below) It…
Read More The Onion and Breach DisclosureMD5s, IPs and Ultra
So I was listening to the Shmoocon presentation on information sharing, and there was a great deal of discussion of how sharing too much information could reveal to an attacker that they’d been detected. I’ve discussed this problem a bit in “The High Price of the Silence of Cyberwar,” but wanted to talk more about…
Read More MD5s, IPs and UltraIndicators of Impact — Ground Truth for Breach Impact Estimation
One big problem with existing methods for estimating breach impact is the lack of credibility and reliability of the evidence behind the numbers. This is especially true if the breach is recent or if most of the information is not available publicly. What if we had solid evidence to use in breach impact estimation? This…
Read More Indicators of Impact — Ground Truth for Breach Impact EstimationNew paper: "How Bad Is It? — A Branching Activity Model for Breach Impact Estimation"
Adam just posted a question about CEO “willingness to pay” (WTP) to avoid bad publicity regarding a breach event. As it happens, we just submitted a paper to Workshop on the Economics of Information Security (WEIS) that proposes a breach impact estimation method that might apply to Adam’s question. We use the WTP approach in a…
Read More New paper: "How Bad Is It? — A Branching Activity Model for Breach Impact Estimation"