Playstation Gamers Face Extended Outage

I agree completely, slfisher.  Anything involving personal information needs to be treated seriously, even if the actual application of the information is light entertainment.

This situation reminds me of the thing a few months back where Apple found out that kiddies were using games on the iPhone to buy things that used real Mommy and Daddy money, and ending up with bills of hundreds or thousands of dollars. 

Both Apple and Sony, perhaps, were guilty of thinking "games," and not taking things like security as seriously as they should have. But we're talking about real money here. It's not surprising that hackers saw the PSN as a target-rich environment.

We need to be thinking about this stuff. For example, I mentioned here last week that I was concerned about the potential for QR codes to be used by hackers, which was news to the person I was responding to. But we need to develop that sort of mindset -- not just "this is cool" but "how can it be abused and how do we protect against that?"

While I agree that Sony has a responsibility to their PSN users and may seem like they are not moving quickly enough to rectify the outage, I can't say that I think it's of dire importance.  Nobody's life is on the line, no critical infratructure is threatened or at risk and it's not like gamers don't have alternatives.

I'm not trying to put down gamers or gaming at all, but in the grand scheme of things, there are more important things to worry about.  I think Sony is doing the right thing in waiting to make sure the network is viable and stable rather than suffer through repeated outages. I have no doubt that Sony will get the network back up and have it available for the gamers.  In the meantime, what's wrong with other modes of game play?

I feel sony should be sued for this. how could you expect a user to read a 13 page user agreement. How can they so easily get off like that ?? Too bad.

People enter into contracts with companies that have 13 pages or more in terms. Contract law is contract law. If you cannot be bothered to read the terms, and you agree to them, you automatically consent and must accept these terms. As the age old adage goes; ignorance of the law is no excuse. Acquiescing makes it law, no matter how tedious and unfair it seems.

The length of time between attack and solution is part of what Jart Armin wrote about in his blog on exfiltration this week.

Clearly, there is a need for IT departments to recognize the challenge and respond more effectively.

I don't know any specific scenarios off the top of my head - but as I mentioned in a previous posting earlier in this thread, it seems apparent that the attackers were inside for quite some time before it was detected and now the forensic work is difficult. This points to a lack of detection/auditing tools and the staffing to handle these systems/services. That, I think, is probably not unusual in many manufacturing companies. Consider this as an example of reduction in resources focused on each element:  - lean mfg -> lean IT -> lean "security" ... does this lead to lean (less) consumers who will use these types of services?

The scenario you suggest, labnuke, just might be a reason for many security snafus. Do you have any background on other companies not making security an enabler?

Is it really the fault of Sony IT? Could it be that Sony IT folks asked for the tools and the support needed to make the data & services more secure but was turned down because security is seen as a cost rather than an enabler? Seems like most manufacturing companies (well, isn't Sony known as an electronics manufacturer?), spend little on IT services unless IT can directly produce product. In this case, Sony was also providing a service that should have a different IT focus than manufacturing - but maybe the mindset was not there - just pondering.

Actually, you're right, Alex. We keep hearing about breaches, each one bigger than the last. And IT seems to be ineffective in helping stanch the flow of information into the hands of the bad guys. The depressing statistics show there's a mind-boggling challenge ahead in protecting user data.

This is the time when service providers with cloud infrastructures should be stepping up to the plate, proving they are often better able to withstand security threats than the average enterprise.

Which  makes the PSN outage all the more alarming.

Come to think of it, if I were Sony, I'd surely be hiding behind the nearest woodshed. Inevitably, though, the music must be faced. And it won't be sweet.

The thing is, these types of breaches are happening with increasing frequency. In every case, there's the same round of complaints about user agreements, as well as worries about credit card data. Nothing ever changes, though. There's gotta be a better way...