Battle.net was hacked!

[hooby]

From what I've been taught at university, optimal security is when the data you store is not worth the work needed to overcome your security measures.

It's a pretty simple concept, actually.

[eisprinzessin]

Where is the break-even point when the amount of data is as massive as in this case? Assuming that the amount of data does not (significantly) increase your work load?

[madned]

Originally Posted by Shoganai

Security is also best done in layers. You have DMZs between the internet and where you keep the REAL data. Each layered DMZ has a firewall and intrusion detections systems. You try to harden your systems as much as possible, but you always design with the "what if scenario" - "what if this server was compromised" etc..

you sound like you know about this more than I, but I'll point out that presumably valve and sony and blizzard have professional security dudes that know all this, probably have applied this as best able.

and still got hacked with sufficient data risk to require public notification.

granted, they're sitting on top of extremely large mounds of loot, which will/have draw(n) unbelievable amounts of attention.
and their defense area is probably huge, distributed systems networked together. and I'd guess the compromises came through non-core systems. valve i think for example had their forum server compromised, which if that was all, it was probably would have been annoying but not that bad, unless you really really care about your forum login, which to a degree I suppose you should.
it's always in the last place you look.

probably a good argument for periodic external audits.

a lot of security is predicated by how your business treats data. the basic business inclination is towards sharing, data that can't be readily shared becomes less valuable, i'm loosely including internal access for mining and whatnot. Which makes IT security a fun line to tread.
Well, guess that's what Data Loss insurance is for, I wonder if they account for lost goodwill.

[Shoganai]

It's what I do

No doubt blizz has super security Leading into their Internet facing battlenet severs - that's why the hackers went after something softer -their VPN / internal networks. It would be interesting to see what type of security they had for that. Since battlenet is hosted at various data enters, it's very possible that the security for it is handled via contract by the data center. It's very possible that their internal LAN/VPN is a separate company or might even be in-house. We won't know for certain. I will say that from my experience companies spend a lot of time protecting their Internet exposed devices, and often overlook or spend less/underestimate the threAt to their own VPN connections into their network.

It's not done on purpose mind you... It's just they are more concerned on protecting the "obvious" targets of attack...

[LostSoul]

Originally Posted by Shoganai

It's not done on purpose mind you... It's just they are more concerned on protecting the "obvious" targets of attack...

Other than the fact that their definition of "obvious" targets happen to be what most intruders are going to view as largely a waste of time attempting to get through. Real ones know that "backdoors" are better and quicker and are the real "obvious" targets anyways.

And with the value of the data/information that can be accessed from these systems of course they're going to be a prime target to start from. Something tells me this is not likely to be the last time something like this happens to Battle.net now that blood is in the water.

[hooby]

The thing is pretty simple actually.

Companies collect personal data, because it is worth a lot of money to them. In order for those companies to make winnings on that data, they cannot put up security that costs more than the data is worth. So they only spend a fraction of the data's worth on security.

They are knowingly taking chances on security, because they don't want to afford security upgrades.

Through my line of work I got a little insight into how some companies handle security of their customer data. That includes one major international credit card company.

Glaring omissions I tell you. Glaring omissions.

So if someone tells you their security is industry standard - know that means "weak".