registrars GoDaddy patches domain hijack hole

The scary thing about this isn't so much that the bug existed, but the appalling lack of response on Godaddy's part until drastic measures were taken to bring it to their attention.

Security is not a profit center, therefore corporations are not interested in fixing things.
And major breaches will continue to occur as a result.

By the way, Nodaddy could be the next Sony if the stakes are high enough for potential hackers.

In their defense, I think security is more difficult to handle in large corporations, because they have lots of employees and every single one of them can be the weak link. For example, if you send a phishing mail to 2000 employees, there is a stronger likelihood that at least one of them will take the bait.

I am sure that there are other bugs in their systems, that are not necessarily critical. A UI that is bloated and overly complex is bound to be more buggy.

Complexity is the worst enemy of security.

sdsinc said:

Security is not a profit center, therefore corporations are not interested in fixing things.
And major breaches will continue to occur as a result.

Click to expand...

It is a major liability. Big corporations need to have a good security team that's on top of their game. Financial institutions have known this for a long time. I think companies are overall getting better at taking security issues seriously, apparently GD not so much. I'm still shocked that their initial response to this very serious vulnerability was to put it on the back burner.

sdsinc said:

By the way, Nodaddy could be the next Sony if the stakes are high enough for potential hackers.

Click to expand...

Strong likelihood (and buzz in the security community) that Sony's incident was initiated by a disgruntled employee. Internal threats are much bigger danger than external ones. Outsiders have to get through your perimeter (or social engineer an employee) to do anything. One pissed off insider with some knowledge and a little too much access can do a lot more damage.

In their defense, I think security is more difficult to handle in large corporations, because they have lots of employees and every single one of them can be the weak link. For example, if you send a phishing mail to 2000 employees, there is a stronger likelihood that at least one of them will take the bait.

Click to expand...

It is. Security teams need to be proactive about educating employees on security awareness. There are btw companies that specialize in measuring your employees' response to realistic phishing attacks and conducting ongoing education customized to your needs.

I am sure that there are other bugs in their systems, that are not necessarily critical. A UI that is bloated and overly complex is bound to be more buggy.

Click to expand...

Hellooooooooo Godaddy! (UI from hell.)

Complexity is the worst enemy of security.

Click to expand...

Sure is.