Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Equifax Software Manager Charged with Insider Trading
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/2/2018 | 5:05:20 PM
Re: CIO
@blackjack: To say nothing of the fact that there is no such thing as 100% secure -- unless you have 0% accessibility.

Moreover, to open CIOs and their ilk up to criminal charges for this kind of thing would mean that they would command mega-salaries in excess of their CEOs -- so as to compensate for the risk.
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
7/2/2018 | 10:31:58 AM
Re: Best Practice?
I cannot help but think that many Equifax employees will have great new careers at Wells Fargo. LOL
BradleyRoss
50%
50%
BradleyRoss,
User Rank: Moderator
6/30/2018 | 2:26:14 PM
Re: Best Practice?
I think that the problem is that there is no defined best practice with regard to securing the data.  The comment that I heard from someone at the FBI was that if they published a best practice or good practice document, people might hold them to it and use the document to avoid legal penalty.  I was somewhat incredulout about this answer since it meant that lack of a "good practices" document made it almost impossible to bring a legal charge against the firm.

Insider trading is a different matter in the law more clearly specifies what constitutes a breach of the law.  It is therefore much easier to bring criminal charges and obtain a guilty verdict.
blackjack0021
50%
50%
blackjack0021,
User Rank: Apprentice
6/30/2018 | 1:16:24 AM
Re: CIO
Come on, reality check. If we charged every CIO who oversaw a network that wasn't 100% secure, and/or patched.... you'd be charging EVERY CIO. Drop down to 90% secure/patched and you'd only have to charge 90% of CIO's, etc. Veracode publicly said they saw 90% of their customers STILL had systems with the same Apache Struts app unpatched six months after Equifax. Not making excuses for them, but being outraged doesnt change reality.... every company has similar issues, and everyone's data was already stolen.
blackjack0021
50%
50%
blackjack0021,
User Rank: Apprentice
6/30/2018 | 1:08:11 AM
Re: Best Practice?
First, he didn't sell stock he already owned to avoid the decrease in value. He purposefully purchased PUT options. Meaning he placed a bet the stock would drop, and when it did he cashed in. Second, google insider trading wiki. Best practice doesn't mean anything here, there are specific laws that say what you are NOT ALLOWED to do. And yes, you could be stuck knowing your stock is about to become worthless, and you can't legally sell it before the news breaks, or warn others to do so.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/29/2018 | 2:49:49 PM
CIO
Equifax's former chief information officer, Jun Ying, earlier this year pleaded not guilty to charges of insider trading related to the data breach Charges on insider trading? How about not securing the network as it should be, so no charge on that!
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/29/2018 | 2:48:04 PM
Re: Best Practice?
This is a cynical representation of it of course but seriously I can't fathom being in that position and would like someone who is better versed legally to shed some light on the matter. I would say this would depend on circumstances of the case, each case would be different, mainly around intention.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/29/2018 | 2:46:42 PM
Re: Best Practice?
Can someone explain to me what is best practice in these scenarios? I think this is a good question. I am not sure if thee is a best practice in this case.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/29/2018 | 2:45:09 PM
Re: Not Surprising
I would be surprised however if it was to be the last person charged in light of the Equifax breach. I would agree. But these are mistakes after the mistakes, not root course of the problem they are in.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
6/29/2018 | 2:44:16 PM
Fallout
Fallout from the epic Equifax data breach just keeps coming For me it it is better to focus on why these type of massive attacks happenin the first place and the focus on what people did wrong once it happened. We have no clue what went wrong.
Page 1 / 2   >   >>


Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5292
PUBLISHED: 2020-03-31
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and admini...
CVE-2020-7009
PUBLISHED: 2020-03-31
Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
CVE-2019-13495
PUBLISHED: 2020-03-31
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field.
CVE-2020-5291
PUBLISHED: 2020-03-31
Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that...
CVE-2019-14905
PUBLISHED: 2020-03-31
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS co...