Hacker News Reader

Comment by konceptz | Hacker News Reader

A breach of emails at a cyber security consulting firm (among other things) is very serious. It gives an attacker (consider a criminal organization) a look at a large number of private firms. On the non technical side is may disclose cyber security budgets, people in decision making positions, strategy and application lists. The technicals could be worse including test accounts/urls, application stacks, CVE lists, release cycles, source code (hope not!) and all the other data you would need to give a trusted external provider of cyber security.

Security firms have so many keys to so many kingdoms it’s frightening.

View on HN

It's worth stressing that Deloitte is not a cyber security firm primarily. It's actually much worse (for them): they're a Big 4 audit company [1].

The fact that they are such a company both explains the situation and makes it worse. First, one should realize that 99.8% of people working at these companies don't know the first thing about cyber security. The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affairs.

Second, attackers getting access to security-related material might be bad, but it will be much worse for Deloitte if people get access to the financially sensitive data that the majority of their employees work on. Not only can this be more directly damaging to their clients, this data and the responsibilities around it are affected by many more laws and regulations.

[1]: https://en.wikipedia.org/wiki/Big_Four_accounting_firms

[2]: This typically also depends on which local franchisee of the Big Four brand you're talking to, but let's not go down that rabbit hole.

In addition to what you've described, there are likely "Privileged & Confidential" conversations between lawyers and those within the org seeking counsel. Those emails are likely the most sensitive in nature.

> The 0.2% of people that do might actually be really good [2] but these consultancies don't tend to put their employees on improving the internal state of affairs.

I think your percentages are off (over ~60% of the firm's revenue is now consulting, a large part digital), but this hits the nail on the head. On the external consulting side, I was regularly in fruitless heated argument with internal IT.

As bad as it is, I think the recovery spin to clients (it's an important point and true) is the the engineers they are getting in a consulting capacity are completely separate to the people managing the laptops.

I do think your second footnote is important too, these are totally separate companies. This is a Deloitte US breach, the IT systems are totally separate. The brand damage (the value of the information in the audit records if unreleased is astronomical) will be shared, but at least the scope of the actual leak will be limited to that member firm.

It can definitely leak more than that. That's why employees are supposed to use PGP to communicate sensitive information between themselves or with the clients. We do that at my work, I really hope they did it at Deloitte.

Encrypted communication of sensitive materials is certainly a mitigation. But I ask you this, are you required to PGP internal conversation about clients?

You have no way to enforce such a policy but not doing it is severly frowned upon.

We are all security experts with different degrees of paranoia, you won't find such a high usage of PGP, Signal and other tools in a different company.

Reply on news.ycombinator.com