Hacker News Reader

Comment by candiddevmike | Hacker News Reader

> no leaking data

Ubiquity collects MAC addresses (https://help.ui.com/hc/en-us/articles/360042384093-Analytics...) and have had data breaches in the past (https://www.twingate.com/blog/tips/ubiquiti-data-breach)

View on HN

Mhh, I'm not so sure I would count that breach against them. It was an inside job from an employee who wanted to export money. I would guess most companies fail at that threat vector.

Thought that link made me curious, why did UI have peoples social security numbers? (I'm not American)

IMO this should have been included in their threat model. The only way to exclude yourself from insider threats is if insiders cannot possibly become threats.

Excellent point. Agreed. Do you have any practical tips on how to achieve this? e.g. a) don't collect data unless it's absolutely necessary to the functioning of your product/service. b) encrypt and limit access to only essential people.

But then what if one of those essential people goes rogue or falls victim to a spear-phishing attack or family ransom etc. How do you mitigate that? Perhaps have a "two keys" to unlock protocol such that two separate team members are always required to unlock sensitive data and i.e. always supervised.

I don't know the solution, genuinely curious how this is solved in practice.

The gist is that as long as your business model is collecting certain data that can be used to identify individuals you must cater for the insider threat and for instance implement segregation of duties. When you do not manage the risk of the data you’re collecting that’s when you end up together with ubiquity.

What duties would you have split up in this instance?

The engineer that stole the data should have needed to collaborate with at least one peer to exfiltrate it. There should be no way for any individual to take this data and clear himself from the audit logs. Segregation of duties in this instance should have made it possible to detect the event quicker and attribute it to this particular employee.

Reply on news.ycombinator.com