I’ve worked with massive customer databases of over a million people multiple times in jobs I’ve had. And while each company has spent tens-of-thousands of dollars in cyber security to protect that data from outside hackers, none have given any fucks at all about who accessed it internally or what they do with it.
I’ve literally exported the entire customer database in two different jobs, dropped the CSV into my personal Google Drive (from my work computer), and worked entire databases at home.
No one has ever known I’ve done it, cared, or checked if I have any customer personal data when I quit.
Sounds like they didn't spend any money on Cyber security's team to properly implement it then....data exfil %100 would have been picked up by any real DLP solution and even barebones heuristics based EDR would have thrown a red flag as well.
Haha, please. You’re talking about machine learning when the best any business is using is antivirus. You forget, Boomers are still running big business and IT departments are running security.
It’s perfect world vs. real world my dude, and real world puts out tender for the cheapest solution.
It sounds like you've been working for Mom and pop shops then, and they're not having audits done. Companies with millions of customers will usually either have in house secops or an mssp handle everything. Point being is, without audits then insurance usually will not be approved for PII loss or they flat out will not work with the company at all. It even more so with HIPAA laws.
I'm with the above commenter. I've worked at many companies of various sizes, from small local shops up to international corporations, including at least one contractor for the US military.
Every one of them had rules and policies and training on security, to varying degrees. But at every one of them, I'd find some vulnerability, or instance where someone was neglecting security. Each time, I'd bring it to the attention of someone in management. Each time (with one company as exception), those warnings would be "heard" and "passed up the chain", and then nothing would happen. Only one company in 20 years of work actually fixed a security issue I found. And no company I've ever worked for was leak proof.
In my experience, until it threatens to cost a company much more money in losses than it would cost to fix the problem, but said problem will not get fixed. That's profit motive. And often it seems they'd rather roll the dice until a loss occurs, and then (maybe) fix the issue.
I've worked at plenty of companies with exfil protection and people still did this. One has 100 devs and 500 total employees
Sounds like the company doesn't have a clue about cyber security then. Tens of thousands is a piddling infosec budget for anything but a tiny company. Also, Insider threats, malicious or otherwise, should always be on an infosec professional's radar.
Companies not giving a shit about cyber security is probably not a secret but it is still pretty common, I think, so nobody should be surprised when there are major breaches.
Infosec is usually seen as an expense that cuts into profits. Assuming top level management and the board give a shit about security that's great but often the risk isn't fully appreciated at the top or is managed poorly.
Adequate infosec requires a company to have very mature processes across the board in IT (and likely beyond). C-level "buy in" isn't enough. If the C level management and board doesn't actively demand it, infosec will lose out to myriad other priorities every time.
The big tell is the org structure. If the CISO reports to the CEO, great. If they're reporting to the CIO, CFO, etc., that can cause conflicts of interest. It can still work. If there is no CISO or they are the same person as the CIO, or if infosec reports several levels down in the org--beware!
Yeah, if I did what he did, I'd be in jail. I would be caught quickly.
There are only a few ways to get immediately fired from my employer, and that's one of them.
This exact scenario is in our annual training. Also I wouldn't be able to in the first place because we block those kinds of sites. Even if we didn't they would likely detect it and come a-knocking lol.
That sounds highly illegal depending on what's on the databases.
Lol same here. Some for ecomm, but the most egregious was underwriting PPP loans. There was a database none of us could access after the loans were underwritten and sent to processing. But most of those documents came in thru the portal and we had to download that package and combine it with anything we got in email... Tax forms, IDs, and all the most sensitive personal info as a lot of businesses that applied were sole proprietors. All those documents say on my local HDD and I catalogued them in case they were needed again.
None of that was handled securely, it was on my home network with no VPN, and after the project was over very suddenly I sat on that laptop for 6 months until they sent a return label. I was a good worker but it was a mass hire and not a lot of vetting that happened.
I’ve worked with massive customer databases of over a million people multiple times in jobs I’ve had. And while each company has spent tens-of-thousands of dollars in cyber security to protect that data from outside hackers, none have given any fucks at all about who accessed it internally or what they do with it.
I’ve literally exported the entire customer database in two different jobs, dropped the CSV into my personal Google Drive (from my work computer), and worked entire databases at home.
No one has ever known I’ve done it, cared, or checked if I have any customer personal data when I quit.
Sounds like they didn't spend any money on Cyber security's team to properly implement it then....data exfil %100 would have been picked up by any real DLP solution and even barebones heuristics based EDR would have thrown a red flag as well.
Haha, please. You’re talking about machine learning when the best any business is using is antivirus. You forget, Boomers are still running big business and IT departments are running security.
It’s perfect world vs. real world my dude, and real world puts out tender for the cheapest solution.
It sounds like you've been working for Mom and pop shops then, and they're not having audits done. Companies with millions of customers will usually either have in house secops or an mssp handle everything. Point being is, without audits then insurance usually will not be approved for PII loss or they flat out will not work with the company at all. It even more so with HIPAA laws.
I'm with the above commenter. I've worked at many companies of various sizes, from small local shops up to international corporations, including at least one contractor for the US military.
Every one of them had rules and policies and training on security, to varying degrees. But at every one of them, I'd find some vulnerability, or instance where someone was neglecting security. Each time, I'd bring it to the attention of someone in management. Each time (with one company as exception), those warnings would be "heard" and "passed up the chain", and then nothing would happen. Only one company in 20 years of work actually fixed a security issue I found. And no company I've ever worked for was leak proof.
In my experience, until it threatens to cost a company much more money in losses than it would cost to fix the problem, but said problem will not get fixed. That's profit motive. And often it seems they'd rather roll the dice until a loss occurs, and then (maybe) fix the issue.
I've worked at plenty of companies with exfil protection and people still did this. One has 100 devs and 500 total employees
Sounds like the company doesn't have a clue about cyber security then. Tens of thousands is a piddling infosec budget for anything but a tiny company. Also, Insider threats, malicious or otherwise, should always be on an infosec professional's radar.
Companies not giving a shit about cyber security is probably not a secret but it is still pretty common, I think, so nobody should be surprised when there are major breaches.
Infosec is usually seen as an expense that cuts into profits. Assuming top level management and the board give a shit about security that's great but often the risk isn't fully appreciated at the top or is managed poorly.
Adequate infosec requires a company to have very mature processes across the board in IT (and likely beyond). C-level "buy in" isn't enough. If the C level management and board doesn't actively demand it, infosec will lose out to myriad other priorities every time.
The big tell is the org structure. If the CISO reports to the CEO, great. If they're reporting to the CIO, CFO, etc., that can cause conflicts of interest. It can still work. If there is no CISO or they are the same person as the CIO, or if infosec reports several levels down in the org--beware!
Yeah, if I did what he did, I'd be in jail. I would be caught quickly.
There are only a few ways to get immediately fired from my employer, and that's one of them.
This exact scenario is in our annual training. Also I wouldn't be able to in the first place because we block those kinds of sites. Even if we didn't they would likely detect it and come a-knocking lol.
That sounds highly illegal depending on what's on the databases.
Lol same here. Some for ecomm, but the most egregious was underwriting PPP loans. There was a database none of us could access after the loans were underwritten and sent to processing. But most of those documents came in thru the portal and we had to download that package and combine it with anything we got in email... Tax forms, IDs, and all the most sensitive personal info as a lot of businesses that applied were sole proprietors. All those documents say on my local HDD and I catalogued them in case they were needed again.
None of that was handled securely, it was on my home network with no VPN, and after the project was over very suddenly I sat on that laptop for 6 months until they sent a return label. I was a good worker but it was a mass hire and not a lot of vetting that happened.