Conversation

Notices

1. Embed this notice
   BrianKrebs (briankrebs@infosec.exchange)'s status on Saturday, 10-Feb-2024 01:34:51 JST BrianKrebs

   Just had another breach notification/quote request go sideways in an icky way. I'm only mentioning it because this has happened to me more times than I care to remember, and it infuriates me every time.

   Here's the scenario. I hear from a researcher who finds bad thing, data exposure, etc. If I can confirm the researcher's findings, I'll then seek comment from the organization in question. Mind you, this effort usually includes both written and oral communications clearly stating that I am a journalist, and that I am working on a story about the problem and its hopeful resolution.

   The response in this scenario involves a reply from a senior executive -- often the CEO -- thanking me for the information, and in the same breath asking if I do any consulting work.

   I can't pretend to know what's going on in the mind of the person who asks me this question in this situation, but as a journalist it always sounds and feels like a thinly veiled bribe offer.

   To my mind, it's bit like getting pulled over for plowing through a red light, and then handing the cop a $100 bill along with your license.

   I always try to respond charitably, by politely declining and explaining that's not really something I do. If I'm not totally insulted at that point, I may even suggest some competent experts. Because god knows anyone who responds this way needs all the help they can get.

   • feld likes this.
   • Embed this notice
     Walker (walker@infosec.exchange)'s status on Saturday, 10-Feb-2024 04:51:25 JST Walker

     • Kevin Beaumont

     @GossiTheDog @briankrebs And cyber insurance allows companies to recoop the cost of a breach / fraud without having to notify the authorities or public. And not suffer a complete financial loss.

   • Embed this notice
     Walker (walker@infosec.exchange)'s status on Saturday, 10-Feb-2024 04:52:14 JST Walker

     • Kevin Beaumont

     @GossiTheDog @briankrebs I have seen "security researchers" use bug bounty / vuln reports as a pitch for their consulting company.

     They find somthing and for a consulting / reoprt generation fee will desclose it to the impatcted compnay. If the compnay declines to pay the researcher issues threats that they will release it to the public or the company partners.

     Its extortion by another name.