-5

Big technological companies such as Facebook, Sony Pictures, Snapchat etc have been hacked in some form or another. Now, this begs the question that how is this possible? Assuming that the company is taking the required precautions to prevent attacks how is it that hackers manage to penetrate systems and gain access to password (albeit hashes, hopefully) and or other private keys/tokens.

The angle of this post is simply that as a web developer myself I'm trying to understand how companies which are involved in technology completely are susceptible to attacks which are avoided/prevented by a lot of other companies.

Is it negligence that causes this or are they facing attacks which (pardon the drama) the world hasn't seen?

Improve this question
5
  • "...how companies which are involved in technology completely are susceptible to attacks which are avoided/prevented by a lot of other companies" - that's an interesting claim to make, i.e. that other companies prevent these attacks. Do you have any proofs that they actually successfully prevent or these attacks instead of being not important enough that others (and they themselves) notice that they got hacked or that they are not an interesting target to hack or that they just had pure luck so far?
    – Steffen Ullrich
    Sep 23 '17 at 18:54
  • " Assuming that the company is taking the required precautions..." - which is another assumption without prove. First, what is actually required in your opinion? Then, how are you sure that this is done? And, are these required things really enough?
    – Steffen Ullrich
    Sep 23 '17 at 18:56
  • @SteffenUllrich fair point, as for the sources I don't have them but one can safely assume that if other companies were attacked and data was being leaked/stolen then it would be reported. Which again, make me wonder that if it people aren't getting passed the security of other companies, how is possible that they are getting passed aforementioned companies' security.
    – Script47
    Sep 23 '17 at 18:58
  • In most sectors companies are not required to report attacks unless others are affected (like personal data stolen). And, most companies try to avoid any kind of public reporting of such problems because this is bad for the business. Thus, that you did not hear from a hack does not mean it did not happen. Also there are hacks where even the victim does not know about it (yet).
    – Steffen Ullrich
    Sep 23 '17 at 19:02
  • Each one of the instances you name have very detailed explanations of how the hacks occurred and what failures made it possible. That makes this question difficult to understand because you can just read the reports. This begs the question, what are you actually asking?
    – schroeder ♦
    Sep 23 '17 at 19:21
3

... how companies which are involved in technology completely are susceptible to attacks which are avoided/prevented by a lot of other companies.

I would argue that this base assumption of the question is wrong.

Instead of assuming that the other companies you did not hear from got not hacked you should instead assume that many of these got hacked too given that even companies with more expertise in information security got hacked. It's only that you did not hear from it, mostly because information about the hacks were not released to the public.

Most companies are not required to make such information public. And given that being hacked is bad for business and undermines trust into the company most companies will not voluntarily declare that they got hacked.

Improve this answer
0

A fundamental principle of security is: there is no such thing as 100% security. There are always vulnerabilities, some are more obscure than others. But they are always there.

Big technological companies with big security teams and budgets are also big targets. For example, there is a lot more to gain from hacking Google and Facebook than defacing a mom-and-pop store's website and such. I work as part of the security team at a large university and the constant scans we notice at the perimeter is ridiculous. Point is, the bigger you are, the more of a target you are.

Another thing is complexity. Smaller networks and simple architectures are easier to secure than large, complex meshes. Complexity is the enemy of security. In large organizations, this complexity means there are multiple teams and people involved and even with all the security policies in place, there is a chance that some security blunder will go unnoticed simply because of the vastness of it all.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.