Actu
Phil Lieberman, Lieberman Software: How to protect yourself after Sony’s PlaystationNetwork Hack
April 2011 by Phil Lieberman, CEO and founder of Lieberman Software
Phil Lieberman, CEO and founder of Lieberman Software, gives his viewpoint on the Sony PSN hack and how to protect yourself from similar breaches.
"Taking a baseball bat to a hornet’s nest is never an advisable strategy. Sony’s strategy in defending its intellectual property was heavy handed and has triggered the “nuclear option” with those that it engaged. Perhaps Sony could learn a few lessons from Microsoft in how it has handled XBOX 360 and Kinect intellectual property.
My suggestions for consumers:
1) Don’t provide your correct DOB or other personal information to this type of vendor (i.e. playing games on-line)
2) Use a throw away email account
3) Use an anonymous debit card for these types of on-line transactions
4) Use a unique password per site
5) Always assume that the company gathering your personal information in totally incompetent at securing the data, and consider what you share with them and how you are going to recover your personal identity after they lose your information.
The reality of cloud data security and PCI today are that they are ineffective and there are no consequences for many companies that under-invest in security. You can be sure that the CIO and CSO at Sony responsible for this situation will probably not be fired or held accountable for their poor decisions. Similarly, the auditor responsible for the Sony account will similarly (in all probability and looking at these situations historically) not be held accountable. The loss of your personal information will (not likely) be nothing more than a “cost of doing business” for this type of company-you will take the pain and they will take a hit to their reputation (maybe).
It is for this reason we are fundamentally opposed to hiding PCI results as well as SAS70 reports from the public. If you don’t have access to the full internal security report of a vendor you are dealing with, you should expect that they have little to no real security and that your data will probably be compromised.
There is abundant technology to prevent this breach and/or limit its scope, but Sony chose to not implement it. Putting this much data in a single database that is publicly extractable with no limits is shameful given what is available today to protect against this type of loss.”
