Hackers Detail How They Allegedly Stole Ticketmaster Data from Snowflake
wired.com
wired.com
I feel bad for the consumers... the companies however, not so much.
That having been said, this is a poor reflection on our industry and its state. Back in the post bubble era "sql injection" was all the rage, but the lesson was if you wrote code you had to have an eye on security...
Now if I dane to say "write your own dam login" at least one person will tell me how hard it is to encrypt passwords.
At what point do we stop outsourcing anything that is about "security"? At what point do we stop running random software and letting vendors into our back end because of shit like this? When do we have the reconning?
All software has bugs, all software is exploitable. SaaS providers need to be better held to account for their failings though. Held to higher standards too.
SOC2 is a joke, especially if you have buckets of cash or know someone in one of the big four. Most other certifications of that sort are too.
I think we're starting to see more companies rebound away from managed services though. It's more work and takes more time, but at least it's easier to wall sensitive services off and lowers a hacker's incentive.
Not to say we should all go back to bare metal, but it's probably worth giving more weight to self-hosting COTS rather than shoveling money and risk onto SaaS providers.