←back to thread

Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

(www.cnbc.com)
410 points gpi | 3 comments | 15 May 25 15:52 UTC | HN request time: 0s | source
Show context
blindriver ◴[15 May 25 16:26 UTC] No.43996627[source]▶
There should be an ISO standard with respect to how much power and information that front line customer support agents have. The more information you need, like changing passwords or accessing personal information, should get forwarded to higher level customer support agents with better training and more monitoring. This way you can design customer support experience with as little exposure to security issues as possible.
replies(3): >>43996724 #>>43997870 #>>43997978 #
1. wepple ◴[15 May 25 18:30 UTC] No.43997870[source]▶
> better training and more monitoring.

That’s very load-bearing. It won’t help.

The CS reps are based in a LCOL country so the opportunity for theft is simply incredibly lucrative.

What is really needed, is customer-in-the-loop for access to their data. The problem is, not all accesses would make sense. Doing analytics over the data of the top 1% of customers, for example, requires some level of access, but would freak out those customers if they had to approve it.

replies(1): >>43997938 #
2. wat10000 ◴[15 May 25 18:37 UTC] No.43997938[source]▶
If it would freak out the customers, maybe they shouldn’t be doing it.
replies(1): >>43999270 #
3. wepple ◴[15 May 25 20:58 UTC] No.43999270[source]▶
That’s a nice thought, but naive.

What about, for example, a higher-tier support person performing QA over someone else’s work? What about DFIR teams doing research on potential abuse? Etc etc.