Hacker News Reader

Comment by deegles | Hacker News Reader

Serious question... how does any smaller, less tech-focused company have a chance of keeping data secure if not even Facebook can do it?

View on HN

You just do the best you can. Totally secure is a myth. As a smaller company, however, you have an advantage that your footprint is much smaller and easier to reason about. The larger you become, the more software you have to run, the more you have to manage, the more lucrative an attack on your systems will be for the attackers.

That's why in security we don't play the blame game when someone gets hacked. We know it could happen to any of us, might already have happened, and we're all doing the best we can with the resources we have.

> The larger you become, the more software you have to run, the more you have to manage, the more lucrative an attack on your systems will be for the attackers.

Also the more people you have who might be compromised. It's almost a certainty that there are people with access inside Facebook who are or have been corrupted. That can happen in a small company too, but the risk/reward is usually lower and there are many fewer people who can be targeted.

One person with a thumb drive can exfiltrate a highly damaging amount of data.

It's not even just corruption, there's plenty of phishing attempts targeted at employees and it only takes one to potentially gain access to a lot of data depending on how systems are set up.

To answer a different question of “why don’t we see more hacks of smaller orgs?”

- Facebook is an incredibly juicy valuable target, worth investing time in

- FB has a very complex application and massive codebase. Your Django web store is far more straightforward

- smaller orgs can get away with not reporting, and don’t get visibility when they are compromised

One underrated option is not to keep extensive personalized records on your entire user base in the first place.

Don’t store personal data for any longer than absolutely necessary (laws/fraud often require some records)

If you must, then encrypt it so that you can never access it (eg you never have a users private keys)

If you must be able to decrypt data (eg fraud/law what have you), encrypt the data to a key where the private key is separated from the rest of your system.

Finally: have billions of dollars and still lose it :-/

they don’t. your startup against 5,000 chinese. who’s gonna win

Well let's not jump to conclusions so quickly. Reading Facebook's report it states that their vulnerability was within a feature they developed. A smaller company is likely to have less complexity in their software. Less complexity == less chance of vulnerability typically.

You can't be perfect. And you likely have less talented engineers than Facebook can afford, but if your software doesn't provide these sort of bridges that Facebook developed then that's one less point of exposure you're testing/fixing/securing.

the u. s. government has hacked CA providers so even companies following best practices are vulnerable. how can any company possibly compete against nation state attack?

Reply on news.ycombinator.com