<story><title>Marriott’s breach response is so bad, security experts are filling in the gaps</title><url>https://techcrunch.com/2018/12/03/marriott-data-breach-response-risk-phishing/</url></story><parent_chain></parent_chain><comment><author>TeMPOraL</author><text>Could someone explain to me what&amp;#x27;s up with the &amp;quot;monitoring services&amp;quot;? I recently read a book on infosec risk, and they keep mentioning that the usual response for data breach involves sponsoring a &amp;quot;credit monitoring service&amp;quot; for customers. Marriott is now referring people to some non-credit &amp;quot;monitoring service&amp;quot;, that (from skimming their site) ultimately tries to fill in some holes left by &amp;quot;credit monitoring&amp;quot;.&lt;p&gt;Here&amp;#x27;s what I don&amp;#x27;t understand:&lt;p&gt;- Why?&lt;p&gt;- Why is that not a service provided by a bank, as a part of having a credit card?&lt;p&gt;- Why do individuals have to pay some random third parties to protect themselves from some fraudster defrauding some bank via data obtained from some company (even if, in publicized breach cases, this gets covered by breached company)?&lt;p&gt;- (Somewhat related) how is it that your &amp;quot;credit score&amp;quot; isn&amp;#x27;t just a number on your bank dashboard, but you have to pay third parties to discover it?&lt;p&gt;It can&amp;#x27;t be that all of this is just a legalized racket, can it? Because if feels like it is.</text></comment>
<story><title>Marriott’s breach response is so bad, security experts are filling in the gaps</title><url>https://techcrunch.com/2018/12/03/marriott-data-breach-response-risk-phishing/</url></story><parent_chain></parent_chain><comment><author>Cyphase</author><text>Things like this seem to indicate an almost complete lack of competence in regards to security and breach response. Can Marriott not afford to hire one full-time, experienced, competent person to oversee security policy? Of course they can. But it seems that they haven&amp;#x27;t, because someone who&amp;#x27;s job it is to oversee security policy should certainly be right in the middle of Marriot&amp;#x27;s response process, and should have caught something like this.&lt;p&gt;I&amp;#x27;m not saying there are no competent people doing security at Marriott. If you work at Marriott doing security work, I&amp;#x27;m not trying to attack you; this kind of thing is not one person&amp;#x27;s fault (unless it really, really, really is, and not even then, because the other people in the organization shouldn&amp;#x27;t have allowed such a single-point-of-failure). But really.. it&amp;#x27;s just abysmal.</text></comment>