"And you didn't notice?" "No, we just assume that the Tax Stamp Buyer always buys stamps." "And who do they report to?" "Uh no one."
-
-
Equifax is entertaining questions on the employment status of the employee they blamed for this, because they blamed an employee for this.
Show this thread -
At least they're saying "No comment" on that, but comment should never have been asked for, because CEO/CTO/etc should have jumped on this.
Show this thread -
Also, since security is a process rather than a single binary event, there were numerous opportunities to improve even if compromised.
Show this thread -
Banks expect to get robbed! They don't expect to get robbed of Literally All Of The Money because it was kept in a single unlocked room.
Show this thread -
Equifax had terabytes of data exfiltrated off of their network. "And did we notice it?" "Nope." "And whose job was it to notice?" "..."
Show this thread -
You would hope that a company with critical information would have wargamed out breach scenarios years ago and put in layers of defense.
Show this thread -
"OK, if they pop a server, what do we do?" "An alarm is raised; we push the Madagascar button." "The what?" "Shut. Down. Everything."
Show this thread -
I will bet at 100 to 1 odds that Equifax has no Madagascar button, the utility of which is obvious years before any particular breach.
Show this thread -
I would also bet that Equifax did not think of the question "Who has the authority to push the Big Red Button?", which serious orgs do.
Show this thread -
Here's another win for Japanese mgmt (we do get *some* things right): https://en.wikipedia.org/wiki/Andon_(manufacturing) … Literally anyone can push the Big Red Button.
Show this thread -
There is a large car company that you're aware of which begins its training about Big Red Buttons with reasons why janitors have pushed it.
Show this thread -
"But why would you let a janitor cost the company millions of dollars?" Because we made a considered decision about tolerances and quality.
Show this thread -
Equifax has apparently not made that considered decision, which is the same thing as making a considered decision... they chose this outcome
Show this thread
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.