Comment Re:fixed ? (Score 1) 35
Firstly, how do you know that's all they did? Secondly, why wouldn't it constitute a fix, if it (y'know) fixes the problem?
My read on the original comment was that dstates was poking some fun at the notion that they 'could' fix the problem. How do you 'fix' unauthorized SSN access? It isn't really fixable - the FAQ sited says they are giving them access to free credit monitoring services. Gee thanks. That doesn't fix anything.
Whoever was responsible for releasing that FAQ needs to do some soul-searching, imho. It seemed, to me, to almost suggest that the users were somehow responsible for this breach, because they "opted in" to a public search option. Excuse me, but they didn't opt into a public search of their SSNs.
The rest of the FAQ was equally disturbing. The section "Who was impacted?" is laughable. But they didn't have the balls to just come out and say "we don't know". It is clear they don't have logging enabled at a suitable level to know who was impacted.
"When did the security incident take place?" Another chuckle here, no? There are one of two possibilities - either they introduced the problem to the system on the 8th of March, 2013 - and again are lacking in accountability; or, as it states, the vulnerability was discovered on the 8th - and they have no idea when it was introduced. So, either they screwed the pooch on the 8th (it happens), or this exposure was much longer in duration than what the FAQ is leading people to believe. In either case, it screams cowardice in the harsh light of accountability.
Pathetic. The whole situation is pathetic. Too many people hiding behind the increasingly inaccurately interpreted notion that 'no computer can be 100% secure' - as if that is an excuse to lay-off, or never hire proper sys-admins and infosec people. As if that is a reason to fly fast and free with updates and patches - rather than having actual dev and test environments. The problem isn't the level of difficulty in creating and maintaining a secure environment - the problem is that people don't want to hire FTEs when they can cling to hopes of buying some silver bullet software program that never needs configuration or maintenance.
"How do I know if my data was exposed?" -
"Why did this Happen?" - yeah... more dodging and reiterating that they have now patched the system. I guess they have been taking lessons from politicians. Why not state the truth? Here's my best guess, 'we are under-staffed, over-worked, under-paid, and pissed off - when we told them we needed more system administrators, we were told to sit down, shut up, and be thankful we still have jobs.'