Data Breach Exposes Thousands of Job Seekers Citing Top Secret Government Work

I personally believe it's a valid excuse. Amazon should be included in the blame and should play a larger part in helping to provide automatic scanning for sensitive data, virus/malware protection, automatic data protection policies and other tools that can automatically detect/protect information. It's the lack of (local enforcement?) of data protection laws as well, similar to how a bar has to ID patrons before serving alcohol or lose it's license to serve. There simply needs to stop being a Wild West mentality in IT. At a minimum it shows the importance of design & UX.

Well, I've used S3 on many projects since it pretty much came out. TBH, security is not much harder that in any &nix based systems.

Default settings are usually NO public read, and it actually takes more work to make stuff publicly readable on S3 than to just leave it as private.

I am thinking the biggest stuff up with this vendor is that they made the entire bucket or bucket key available publicly, which is a pretty dumb, and deliberate thing.

If you wanted people to access resumes on an individual basis via a known web link, then just make the documents individually publicly readable, but don't make the entire bucket readable by default.

Better still, use Amazon's 'one time' or time based permissions to make sensitive files only available to a certain person or for a limited time.

Re: UI - Amazons new S3 console is spades better than their old one - plenty of auditing and analytics tools there too which can prevent silly mistakes like this.

There's always time to implement basic security when it comes to personally identifiable info. This was simple ineptitude.

> someone probably didn't have time to implement secure link, just decided to make the bucket open.

That sounds more likely. AWS permissions are tricky, but not so tricky that it's easy to leave a bucket wide open like that. In my experience, they're much more likely to lock out someone who should be able to access them than to allow someone who shouldn't. Just bad practice to give up and allow anyone in.

4 million people have top secret clearance. what is and isn't a good idea given this state of affairs is ummm...

[1] https://www.washingtonpost.com/news/worldviews/wp/2013/06/12...

Unless you're a whistle blower exposing corruption.

CVs like these are sanitized to only contain unclassified ingormation regarding otherwise classified work. So the problem here is not classified information leaks, it would be better ability to target certain folks based on their work (Although honestly, many folks who have done classified work seem to not use much discretion when setting up LinkedIn profiles).

I'm sure there are lots of people paid to not work simply because of what they know

I left the intelligence community and it was a pain in the ass. There are portions of my career that I simply can't talk about.

My first job out was the worst. Easily half of the "tell me about a time when you.." questions required me to be vague and speak about skills instead of projects, people, customers or goals. I was lucky because the CEO of that company was a friend of a friend and they did a number of classified projects themselves.

If it had been all civilians or non-IC connected firm, it would have been awful.

As a reaction to all that, I went deep into the open source community and blogging with the goal of always having projects and a portfolio I could talk about and show. Best decision I ever made.

If you're getting another job in intel, you send the references over email on a secure network.

If you're leaving the intel community, chances are your references are really pertinent. All the "I can't say" responses will derail a lot of interviewers though.

Quite frankly if you're a spook you don't leave your job until you retire, or you go to the public sector where the bar is "this person has a clearance"

Hiring is not very competitive for government work. They are usually hiring warm bodies with clearances rather than talent.

If you're going from government cleared work to something completely different it's still fine to get a reference from people you worked with, just there are some pieces that are filtered

After publication of the first few NSA documents via Snowden, people searched Linked In for keywords like XKeyscore. And found users who had cited them in work history. Security by obscurity?