Slashdot Mirror
Sony's Plan To Tighten Security and Fight Hacktivism
mask.of.sanity writes "Sony Entertainment Network is rebuilding its information security posture to defend against hacktivism. It includes a security operations center that serves as a nerve center collating information on everything from staff phone calls, to CCTV, to PlayStation gamers. If it is successful, the counter intelligence-based system will be deployed across the entire company. 'At Sony, we are modifying our programs to deal less with state-sponsored [attacks] and more with socially-motivated hackers. It will be different,' said Chief Security Officer Brett Wahlin."
good for them
pity I wont buy another sony product ever again.
This is treating the symptom not the problem.
Don't be dicks.
Hacktivism is to protest political ends. I belive the term is misused here...
As part of the society, you should think about how not to become a target of hacking activism. Especially when it's impossible to crush every one of the "hackers".
Better yet, convert them into your loyal customers, and even better, direct their anger to your competitors.
Colorless green Cthulhu waits dreaming furiously.
... didn't you make security staff cuts weeks before PSN got hacked?
"deal less with state-sponsored [attacks] and more with socially-motivated hackers"
Where "socially-motivated" means "radical Marxist". Smart. It's going to be loose associations of communists that are a vastly bigger threat than the communist states of the world. Just like with Islamic terror.
About time they get it together - especially when your not the most liked kid on the block.
All they have to do is push a download that turns on the Playstation Eye of people they don't like.
... correlates with how stupid and high-handed these rules are. Make sane rules, and you only have to defend against a handful of criminals. On the other hand, impose some utter crap on people, and you face a whole legion of righteous adversaries. Good luck, Sony...
So shutting off PSN access for millions of gamers is now considered hacktivism? Going after Sony's game division, which has almost nothing to do with Sony's corporate division, is now hacktivism?
I know that the Slashdot crowd is extremely anti-Sony but I fail to see how denying paying consumers the ability to play games is hacktivism. Or preventing dozens of new games from getting released on the PSN store, and allowing those companies and artists to sell their titles, is hacktivism.
NATO just dropped a few billion for one! Now SONY will have one! Where's yours!?!?!
I smell Y2k sized contract money now!
I am now a Anti-Cyber-Threat-Security-Response-Operations-Analysis-Coordination-Center Specialist!
In the train:
Passenger: "What line of work are you in?"
Me: "Cyber Security!"
Passenger: "Do I need that?"
Me: "Does your wife know about the email to your girlfriend on your laptop that I am reading right now?"
Passenger: "Ok, I'll buy some."
Passenger: "But do I need to wear that tinfoil hat . . . ?"
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Oh i hate the term. Hackers dont hack the phone calls of the staff or hack into cctv to do harm.
Political activists use legitimate methods to increase their influence.
If you hack into phone calls for purposes different from demonstrating a problem then you are not a hacker. if you use force (like the Anonymous asshats) you are not an activist.
Now they discredit political activists and hackers at the same time by calling them hacktivists, joining two very different things. in order discredit both and connecting them to thinks none of both is related to.
Well, no matter what kind of security operation they want or rebuild they can't prevent hackers to hack their game in the future.
Professional web designer London
read this:
https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal
http://en.wikipedia.org/wiki/Sony_rootkit
Never forget, never forgive.
The classic 1998 commercial, original 90 second version
http://www.youtube.com/watch?v=FlRPU5XxWlA
And who, pray tell, decides what is legitimate?
Answering that question is what politics is all about. The point of engaging in politics is to determine legitimacy. Look at any political movement and you will see this struggle to define legitimacy. Legitimacy is not the starting point: it is the outcome. You are begging the question.
Which is, of course, because you are trying to propagate your definition of what is legitimate. You are not describing politics: you are engaged in it. You are not a disinterested obsever: you are a participant.
TFA claims that Sony's new CSO, Brett Wahlin, "served as a counter-intelligence officer in the US Military for eight years during the Cold War." The final year of the cold war is generally agreed to be 1991, when the Soviet Union dissolved. This suggests he started working as a C-I officer no later than 1984. Yet the photo in his recent bio suggests he's in his early 40s now. So either 1) he's a prodigy and worked for the US military during high school, or 2) he can travel in time. Either way, the hacktivists might have met their match! Well played, Sony.
Say, policemen go along the sidewalk in bulletproof vests. The vests have a "week point", a "flaw", - the neck and legs are not completely protected.
Should one want to point this bulletproof vest's vulnerability as a service to community by shooting at policemen' weak points?
(The correct answer certainly is: no).
Why not orient your company and your policies so as not to actively piss off people who like tinkering with their own electronics and people who don't like DRM and spyware-riddled merchandise?
Why was anyone buying PS whatevres let alone a month to month service?
There are cushier jobs than leading Sony Entertainment Network’s burgeoning security shop, but Brett Wahlin was never one to shy from a challenge. So when the entertainment giant looked to revamp its security in the wake of the devastating hacking attacks against its PlayStation Network last year, the former McAfee Chief Security Officer answered the call.
McAfee, seriously? What, they couldnt shell out a few more bucks to get a guy from Norton? :)
Anons need not reply. Questions end with a question mark.
There's sonmething new from Sony you absolutely MUST have.
Upward mobility is a slippery slope - the higher you climb the more you show your ass.
Poor Sony. After all they've done to..er..for their customers. Karma is definitely a bitch
Suppose you were an idiot. And suppose you were a member of congress. But then I repeat myself. -- Mark Twain
Evidently Sony learned nothing from the cause/effect relationship of their brutal approach to both security and their users. Sony set the stage by deploying rootkits and other security attacks on their own customers. Then they retroactively deleted the Linux (OtherOS) option from PS3s, many of which they'd sold to hackers for the very purpose of "hacking Sony". Though OtherOS had been crippled from the beginning, there was little effort by PS3 hackers to crack the lockout from the hardware, until Sony tried shutting all OtherOS users down. Then hacking the PS3 became necessary for every PS3 Linux user.
It was a case of "when guns (OtherOSes) are outlawed, only outlaws will have guns (OtherOSes)". Why stop at just keeping what you paid for, when you had actually paid for more than you'd originally gotten? Sony had destroyed any ethical relationship, and the community was organized.
Now, I'm not pinning all or even most of the attacks on Sony beyond keeping Linux on the small PS3 Linux community - maybe not even any of them. But that episode showed the world Sony was a legitimate target. Then after some success in keeping what they paid for resulted in arresting the hacker, Sony was now a legit target for both legitimate hacking and just plain "bash the bad guy". Combine that with Sony's copyright overreaches, its region-encoding scams, its DVD backup denials (also broken and showing Sony both greedy and vulnerable) - Sony fanned the flames of backlash.
Now Sony is just escalating the conflict. It would be a lot cheaper to give hackers back Linux, this time with some support, to give them more of a common interest with Sony. Instead Sony is further defining itself as an enemy instead of a partner. Sony's awareness of social networks seems to be purely as either enemy or marketing victim. This will not end well. In fact it will not end, and many will suffer.
--
make install -not war
I hear the CEO recently heard about this thing called a "firewall" and is very interested in looking into one. He also heard a rumor about "passwords" and their possibilities for increasing security. Things are a changing at Sony it seems.
Just another ignorant American.
you,re complaining about the privacy policy?
Do you use google or facebook or twitter?
Who controls the British Crown...
Who keeps the Metric System down?
Who holds back the electric car...
Who makes Steve Guttenberg a star?
Oh wait...
Who controls your digital rights...
Whos gaming networks down all night?
So-ny, So-ny...
Who holds back GNU standards
Who thinks privacy's FOR the Birds?
... incompetence?
Hactivism isn't the problem - it's companies like Sony that store data in plain text that's the problem.
There is no such thing as a complete secure internet connected system. If it's connected it's breachable. If data is stored it's stealable.
It's high time limits on what companies can store should be placed upon them, to prevent nefarious use by thieves, corporations, and government (who are one and the same here in north america).
Sony's computer-related devices (for even very loose definitions of "computer") are only a part of their revenue stream. Sony's real money comes from producing and distributing content, so measures to protect that revenue stream are in order, even if it negatively impacts some other revenue stream. Certainly, Sony's draconian DRM has alienated some fraction (even a large fraction) of people who have purchased Sony computer-related products, but that is not that big a deal to Sony management, because they listen to their accountants, not their conscience. The bad PR over the root kit deployment was pretty much confined to that (vanishingly small) fraction of their total market demographic that even knows (or cares) what a root kit is. Business is business -- corporations who think profit has to be moral (for whatever value of moral you care to use) are going to make a lot less profit than those who aren't similarly encumbered.
State sponsored terrorism is okay (mostly likely because it is done for the sole benefit of the corporation which sponsors the state), and individual, revolutionary terrorism is not, for the obvious reason.
Most people don't know this, but sony has a product called GraceNote. it recognizes audio and videos. If you duplicate a CD or DVD (or even mp3s to some degree), this data is sent to a Sony server to recognize it. They charge companies for these lookups. Apple uses GraceNote in iTunes. Microsoft has had deals with them in the past. Ford uses them in Sync. There is only one competitor in this space besides sony.
Every time your car, game console or PC detect your CD either Sony or Rovi (Macrovision) gets money.
Why isn't anybody talking about the change in focus away from *state-sponsored attacks*? What does that even mean in this context?
Was Sony seriously focusing on preventing militaries and intelligence agencies from attacking its infrastructure? Damn, they must have seriously pissed off some powerful people with those rootkits!
And that still doesn't explain why their security was so damn shoddy. Unless... maybe their old CSO was focused on state-sponsored attacks, but a risk analysis put the likelihood of such an attack at near zero, so they slashed their security budget. That almost makes sense...