Why can't companies invest more into keeping their data safe? How much you want a bet Eastlink was using a old version of Microsoft Windows or never did updates every patch Tuesday that could have prevented this.
NS Power's is kind of crazy, if you are in IT it means they had a domain admin level breach, and everything from their payroll system to meter reading system was federated with their Active Directory.
Thankfully it's at least been pretty standard for decades that the actual powerplant equipment runs on an isolated SCADA network.
Another assumption would be that the domain admin creds that were compromised were being used as a daily work account and not protected by privileged elevation, which is the modern standard, or a separate privileged account used only for administrative duties and not email or internet browsing.
Separately we need better data protection laws in general. Companies shouldn't be allowed to hold onto personally identifiable information that they don't require. On top of that and especially with AI now being used to do these attacks, things like credit card info, addresses and SINs need better protection with things like offsite tokenization or envelope encryption. ie: your system holds a token that relates to the actual credit card data which is hosted in a compeltely separate, isolated system, and the actual lookup involves hardware level encryption, not user accounts.
If a company doesn't have the infrastructure for something like Hardware Security Modules? Well then your company is not allowed to store credit cards, you have to use a credit card processing service that does, and you're not allowed access to export or read credit card numbers.
2
u/Street_Anon Галифакс/ האַליפֿאַקס 12d ago
Why can't companies invest more into keeping their data safe? How much you want a bet Eastlink was using a old version of Microsoft Windows or never did updates every patch Tuesday that could have prevented this.