1. Breach disclosed on a Friday.
2. The data about 500m people DOES NOT belong to their guests, but to Marriott. They have every right to allow it be compromised.
3. Breach unlikely to be costly, and affect stock price.
4. Other hotel chains should consider incident response.
2. The data about 500m people DOES NOT belong to their guests, but to Marriott. They have every right to allow it be compromised.
3. Breach unlikely to be costly, and affect stock price.
4. Other hotel chains should consider incident response.
It’s hard to tell if the Marriott breach contained cardholder information, but if so, PCI-DSS needs to take there fair share of the heat... and the QSA for that matter.
An intruder was silently running around Marriott’s system for 4 years. 4 YEARS. Imagine the amount of work necessary to get security back to a known good state and confident that you did so. Might take another 4 years in any system that large.
I’d bet that Marriott has a cyber-insurance policy that’ll cover a lot of their costs. If anyone happens to have any details, please share.
When a breach goes undetected for so long, especially on a large corp with a massive network, it’s highly unlikely there was just one intruder.
And where was @briankrebs all these years!? I mean cmon, he’s supposed to be our best IDS after all right!
