bloomberg on supermicro: sky is falling

Wed Oct 10 14:21:40 UTC 2018

Allowing an internal server with sensitive data out to "any" is a serious mistake and so basic that I would fire that contractor immediately (or better yet impose huge monetary penalties.  As long as your security policy is defaulted to "deny all" outbound that should not be difficult to accomplish.  Maybe if a couple contractors feel the pain, they will straighten up.  The requirements for securing government sensitive data is communicated very clearly in contractual documents.  Genuine mistake can get you in very deep trouble within the military and should apply to contractors as well.  I can tell you that the "oh well, it's just a mistake" gets used far too often and its why your personal data is getting compromised over and over again by all kinds of entities.  For example, with tokenization there is no reason at all for any retailer to be storing your credit card data (card number, CVV, exp date) at all (let alone unencrypted) but it keeps happening over and over.   There needs to be consequences especially for contractors in the age of cyber warfare. 

Steven Naslund
Chicago IL

> Important distinction; You fire any contractor who does it *repeatedly* after communicating the requirements for securing your data.
>
> Zero-tolerance for genuine mistakes (we all make them) just leads to high contractor turnaround and no conceivable security improvement; A a rotating door of mediocre contractors is a much larger >attack surface than a small set of contractors you actively work with to improve security.