[bogomipz]

I took the OPs comments as referring to the fact that management either:

a) didn't know the company was hacked.

b) claimed they didn't know they were hacked,

c) didn't bother to do proper discovery to quantify the extent of the hack until years later.

[sandworm101]

And that would have been covered under nist or iso or any other resonable standard. My point is that once you look into these companieas, get beyond the tech stuff, virtually none implement proper security on such large deployments.

[bogomipz]

>"virtually none implement proper security on such large deployments."

Can you provide a citation for this? Otherwise it seems you are suggesting because Yahoo was lacking that this means all SV tech giants are lacking.

[sandworm101]

Well, without ndas make it hard to find actual reports, but take ashley-madison. Millions of users, talk of a billion-dollar ipo, and the post-hack report by the canadian and austrailian privacy ministers found they had no formal security plan.

[bogomipz]

So you can't actually substantiate your claim that "virtually none implement proper security".

I am not sure why you think that mentioning a second incident makes your statement true for the majority of tech companies.

[digler999]

so according to your logic, one massive hack means all sites are insecure ?

[sandworm101]

No.. working as a compliance attorney, along with all the industry contacts that entails, allong with a steady stream of reports such as the OP (also target et al) gives me grounds to say that proper security is not an industry norm, that the opposite is more likely.

In doubt? Ask around for how many organizations have a dedicated ciso or privacy officer.

[bogomipz]

And Yahoo the company we are discussing has a full time CISO, now at Facebook:

http://www.businessinsider.com/alex-stamos-leaves-yahoo-to-b...

As does Google: http://www.csoonline.com/article/2928798/security-leadership...

As does Twitter: https://www.linkedin.com/in/mcoates

as does Uber: https://newsroom.uber.com/joe-sullivan-joining-uber-as-first...

As does Apple: http://www.reuters.com/article/apple-encryption-executive-id...

As does Amazon: https://www.rsaconference.com/speakers/stephen_schmidt

So I would say its pretty common. Just because its not common at the Ashley Madisons and Targets doesn't mean its uncommon elsewhere.