As more and more details come out about this week’s security breakdown at Sony, one thing is becoming clear: even if you think you’re safe, add a couple of more security layers. Because you are not safe.
According to the New York Times, the hackers made off with a database that included customer names, addresses, usernames, passwords and as many as 2.2 million credit card numbers. Reuters is running a story that covers the number of class action lawsuits being filed on account of the breach. The price Sony could eventually pay out in time, legal fees and lawyer costs are on the clock.
Why?
VentureBeat tracked down George Hotz, aka “GeoHot”, who recently settled a lawsuit with the company over hacking into the PlayStation 3’s hardware. While Sony may consider him as public enemy number one, Hotz relies that he had nothing to do with the attack. Considering the fact that he recently settled with Sony rather than go through years of legal wrangling, (plus the fact Hotz’s main gig is hardware hacking, not database cracking), it would tend to exclude him from the line up. But his reaction sums up what is going on nicely:
“The fault lies with the executives who declared a war on hackers, laughed at the idea of people penetrating the fortress that once was Sony, whined incessantly about piracy, and kept hiring more lawyers when they really needed to hire good security experts. Alienating the hacker community is not a good idea.”
And therein lies the point. Companies feel it is easier to hire another lawyer rather than to fix the problem. That the threat of lawsuits is a deterrent to hackers. It isn’t. You have a database with the names of customers and and their credit card numbers. Threatening legal action with a room full of empty suits doesn’t matter, especially when the chance of catching the bad guys is slim.
As Hotz points out, engaging the hacker community may be the best option. Hackers are, for the most part, highly intelligent and creative people who are usually more than happy to point out the failures of your system. Make it a once a year game – give the money you would pay an overpriced lawyer to write nasty letters to the first person who can crack your system and show you where to fix it. Admit you don’t have all the answers.
After this fiasco, it might even be seen as a huge cost savings.




