Hacker News Reader

Comment by BinaryIdiot | Hacker News Reader

Not really any details in that post. As a company offering a Cloud IAM I would expect some top notch security and while I understand that doesn't mean they would be "hacker proof" I'm surprised they need to go through an independent firm just to figure out the how and the extent of the intrusion.

This happened less than a year ago, too! https://www.onelogin.com/blog/august-2016-incident

View on HN

I think the use of an independent firm is supposed to reassure everyone that they are taking it seriously and aren't going to brush it under the carpet. It's the same reason why companies use independent firms to do penetration testing etc, rather than simply stating that these are managed internally.

Sure and I get doing that in addition to some work internally. But the way this was written gave me the impression that someone broke in, they don't know anything about it and are passing it off to someone else.

Maybe that's the wrong impression but with virtually zero details contained within the post regarding the intrusion it certainly doesn't inspire much confidence.

Yup, this combined with the fact the CISO seems to be a business person instead of an actual security expert has me screaming anything but OneLogin.

I get the impression this company behaves like a typical mobile app instead of having the strong security practices you would expect from a company like this.

Hiring an independent firm is an accepted practice to show that nothing is going to be hidden or watered down. If company (especially big one) handles breaches themselves, it usually boils down to trying to save face with bad PR or outright lie.[0]

0. https://en.wikipedia.org/wiki/Adobe_Systems#Customer_data_br...

I'm on mobile and at first mistook the authors bio for the majority of the article.

Reply on news.ycombinator.com