UpGuard

UpGuard | Mountain View, CA | Onsite / Partial Remote | Full-Time | https://www.upguard.com/ UpGuard are looking for all types of engineers to work on front and back end technology stacks to build our our next generation configuration & resilience platform. We're looking for smart, driven engineers that have a vision and the ability to build it. We create enterprise software but operate in a more startup like environment with free lunches, casual work place, equity and a fully stocked beer fridge. We've recently raised our series B, and are still at a great size where any new employee has a real impact on the product. Own your own projects from start to finish. Have a better idea of how to implement a feature? You're free to build it. Everyone knows everyone here, culture is a big priority and we look after our staff. Our stack is Ruby / Rails, GoLang, C#, Postgres, Memcache, Redis, HTML, CSS3, JavaScript, AngularJS, Git, OSX Im a long time engineer here, drop me a line if you have any questions or want to submit a resume - cheyne (at) upguard.com

100s of millions have definitely been exposed already. The best defence is probably to be a baby so your risk window is minimal. I haven't been able to pull that off personally, so I follow the other recommended piece of advice which is to keep your credit checks permanently frozen with the agencies and only temporarily thaw it for specific usages. https://www.upguard.com/breaches/social-insecurity-billions-of-social-…

These are generic, and quite weak recommendations on the part of the CISA. And that was the excuse of the CIA director, while knowing very well these are for regular work not real-time battle plans. Also those recommendations from the CISA recommend to use password managers...like Lastpass and 1Password and others, who had multiple security breaches. If this is the type of Cybersecurity the US government applies to day to day work, its much easier to understand the field day North Korean and Chinese hackers seem to have all the time. https://www.upguard.com/blog/lastpass-vulnerability-and-future-of-pass… https://www.forbes.com/sites/daveywinder/2024/08/07/critical-1password…

Sort of, political parties have profiles for most voters based on their public profiles etc, they compile all info and predict your stand on various issues and when those databases leak..... and they do: https://www.upguard.com/breaches/the-rnc-files you are no longer protected, your best bet is to not have public facing anything at this point in time

Security and privacy are complex topics—most developers I’ve come across aren’t deeply familiar with best practices or well trained to architect secure systems. Also, security, privacy, and compliance collectively form some of the most substantial challenges for small and medium sized SaaS companies when selling to enterprise customers. On the consumer side, the massive influx of recent data leaks (https://www.upguard.com/blog/biggest-data-breaches) make this issue critical. Similar to what Stripe did for payments, I think the solution lies in abstracting away implementation details for secure architectures that need to commonly be built from the ground up. To name a few concrete components of a secure SaaS application that can be abstracted: - end to end encryption (for p2p file transfer and for teams) - multi-tenancy in data architectures - secure data stores (with row/column, and even element level obfuscation of sensitive/PII data): obfuscation would be dynamic and highly configurable through an ACL style interface - data severability: the ability for customers of an application to delete (or broadly, govern) their data should they feel at risk In summary, a highly secure, scalable, and governable data backend for application developers to use instead of building their own. All accessible through an API which can be used a la carte. Would love to get some thoughts on this approach from the community? What do you think? PS. If you’d like to chat directly, get in…

> Limited IO bandwidth in middle and upper management alongside difficult schedules (we covered that one already). Take 2 steps above engineer on an org chart and detail becomes invisible, the vast majority of tasks begin to resemble a teenager at a mall with their dad's credit card. Meaningful technical validation phases are almost unheard of in many organizations, and largely antithetical to agile. I'm sorry, but what are you trying to say? "Antithetical to agile" - is there a point beyond some non-nonsensical, made up scenario? Every major organization with a cloud budget cares about optimization today at some level. This hasn't changed in over 20 years because those budget dollars used to be directed at data center costs. Now they're more fluid and can be more impactful when people make mistakes or aren't making sure to optimize up front. > Because they market to folk who never take the time to model comparative costs. In any project I considered them for (3 I think, <$15k/year each), Digital Ocean was significantly more expensive than AWS. I follow my spreadsheets, the industry follows marketing. Then share some examples from said "spreadsheets". Because for straight instance pricing DO beats AWS pricing in most every way. This is one of a handful of bread and butter services AWS offers (lift and shift compute). DO also does, most often, better with respect to performance (CPU/compute) when comparing directly [0][1][2][3]. This calculator [4] at DO showcases…

I continue to be surprised by the so-called "S3 Bucket Negligence Award" which feels like the intersection of IAM and S3 configuration ugliness that result in so many public horror stories like: - https://www.upguard.com/breaches/attunity-data-leak - https://www.lastweekinaws.com/newsletter/reinforce-meant-learning/

No website being silly enough to store in plaintext, is silly untoitself https://www.upguard.com/blog/biggest-data-breaches plenty of cases where it happens... and plenty more of viably crackable breaches

I would be very surprised if this hasn't been going on for years already, back in 2014 they were already as far as using Facebook users as test-groups [0]. Then there was also the case of a Pentagon contractor leaving their AWS buckets open exposing billions of scraped social media posts. [1] As much as people can reach for benign reasons for "research" like this, the reality is that it's not solely done to "understand" movements but rather to better influence them [2]. [0] https://news.vice.com/en_us/article/zm5k4a/the-troubling-link-between-… [1] https://www.upguard.com/breaches/cloud-leak-centcom [2] https://www.theguardian.com/technology/2011/mar/17/us-spy-operation-so…

The "540 million records" wording seems misleading (probably intentionally by UpGuard and/or TechCrunch). The screenshot on https://www.upguard.com/breaches/facebook-user-data-leak leads me to think that this is 540m object records of various types (posts, comments, etc), not records of 540m distinct users like some readers would think. It sounds like a lot, but it's not. You could probably scrape that much data from public Facebook pages in a few days without even being logged in, especially a few years ago. Heck, you could say right now that Reddit has billions of user records exposed if you define them that way. The Hacker News first page itself links to thousands of user records :)

Original blog post link: https://www.upguard.com/breaches/facebook-user-data-leak Mods, please update or flag as dup if it is so

Research: https://www.upguard.com/breaches/facebook-user-data-leak

> Isn't this in the actual report Ok found the source referred in the report https://www.upguard.com/breaches/aggregate-iq-part-two-brexit I still don't see where it says "Cambridge was pivotal to brexit." It links it to something called "AggregateIQ" not Cambridge. Am i reading this wrong?

Probably the link should be changed to the Forbes piece or the original disclosure. This was not Newsweek's original reporting. https://www.forbes.com/sites/thomasbrewster/2019/01/16/massive-oklahom… https://www.upguard.com/breaches/rsync-oklahoma-securities-commission

Can the link be changed to https://www.upguard.com/breaches/public-domain-how-configuration-infor… The original link is essentially blogspam.

Especially when stuff like this tends to happen a lot with AWS: https://www.upguard.com/breaches/cloud-leak-inscom

Actual write up: https://www.upguard.com/breaches/aggregate-iq-part-one Important to note this leak only (as of now) ever mentions ted cruz - nothing to do with Trump's campaign beside some handwavy connections between this marketing agency and cambridge analytica. Bannon is also literally never mentioned in the write up.

Here's the report from UpGuard, who found the breach: https://www.upguard.com/breaches/cloud-leak-alteryx It has more detailed information about the dataset.

AWS misconfiguration, apparently. The Ars article links to the original source, which provides additional details: https://www.upguard.com/breaches/cloud-leak-centcom

The discoverer's article is quite informative: https://www.upguard.com/breaches/cloud-leak-accenture

Source blog post (and free of CNN's obnoxious autoplay video): https://www.upguard.com/breaches/cloud-leak-chicago-voters As soon as I read the headline, I immediately thought "AWS misconfiguration". A few recent massive government-data breaches (by contractors) have fallen into that category: June 2017: http://gizmodo.com/gop-data-firm-accidentally-leaks-personal-details-o… May 2017: http://gizmodo.com/top-defense-contractor-left-sensitive-pentagon-file… Note that all of these breach reports (including this Chicago one) come from Upguard, which seems to have a method for scanning/crawling public S3 buckets.

Clickable: https://www.upguard.com/breaches/verizon-cloud-leak

Here is the direct link to Upguard's write up (most of the Gizmodo details are here): https://www.upguard.com/breaches/the-rnc-files It is mostly publicly available data, but not always easily accessible (states have varying requirements and methods of acquisition), firms go through quite a bit to get aggregate files in all 50 states. For them to be put up with no protection is jarring. But not surprising with other recent disclosures. I only wish we had access to the files to do some queries across them!

UpGuard | Mountain View, CA | ONSITE | Multiple engineer and designer positions https://www.upguard.com/careers

I found an article about their last downtime and either way they are losing a lot of money https://www.upguard.com/blog/the-cost-of-downtime-at-the-worlds-bigges…

There's no shortage of articles on this, e.g. https://www.upguard.com/articles/python-vs-ruby For the record, I worked 8 months years ago on a RoR application. I now work on a django application. I like them both.

Have you ever seen a news article talking about a data breach? They're posted here pretty regularly, and most big news outlets discuss the more important ones when they happen. I only ask because your comment sounds like you don't think security is a concern for businesses. It is, so much so that worldwide, companies who have been breached spend close to $4 million cleaning up after the incident [1]. In the US it's actually more like $8 million to clean up after a breach. And if you read the report, data leaks (like customer info sitting in an unsecured Google account) account for half of all breaches. [1] https://www.upguard.com/blog/cost-of-data-breach I'd like you to understand how Google Docs poses a risk to businesses. Imagine you want to share a customer list with someone else in your company, but you don't want to use Word and OneDrive like IT has approved. So you put it in Google Docs. Now sitting in your personal and unsecured Google account is a list of your company's customers. Maybe some pricing info, maybe the email address of a contact at the company, that kind of stuff. Now your personal Google account is compromised. It happens all the time, but this time the hacker finds your company's info. Maybe they sell it to one of your competitors and your company loses business. Maybe they use it to spear-phish your customers. Maybe your company's customers get breached because you put their information in an unsecured location. Now lets say this goes on long…

Let's not forget that Alteryx sells the data of 123 Million American Households. That data Was Exposed Online https://www.upguard.com/breaches/cloud-leak-alteryx "the data was part of a product - the Alteryx Designer With Data - that sells for around $38,995 per license. In its own marketing for the Experian service, Alteryx notes that the database contains "consumer demographics, life event, direct response, property, and mortgage information for more than 235 million consumers." 'It included an extraordinary range of personal details on residents, including addresses, ethnicity, interests and hobbies, income, right down to what kind of mortgage the house was under and how many children lived at the property. In total, there were 248 different data fields for each household, according to the researcher who uncovered the leak data this week. Whilst there were no names exposed, Chris Vickery, a cybersecurity researcher from UpGuard, told Forbes it was simple to determine who the data was linked to, either by looking at the details or by crosschecking with previous leaks. He found the data was sitting in an Amazon Web Services storage "bucket," left open to anyone with an account, which are free to obtain." https://www.forbes.com/sites/thomasbrewster/2017/12/19/120m-american-h…