Red Hat Confirms Security Incident After Hackers Breach Gitlab Instance

And, never forget: what a company preaches and advertises is not the same with what the company is actually doing.

In theory, being ISO27001 means that you're environment follows best practices and has a somewhat sane security posture.

To the business people, a new customer demands that you have ISO27001 certification before they'll sign the $$$$ contract. The salesperson does not care HOW you get the certificate, just that you have it, they need this contract signed!

The department wasn't designed with security in mind, so implementing everything required by ISO will take many months. But sales needs $$$$ now! The CEO, CFO, and CTO are aligned: money now!

So, there's high pressure to pass the audit quickly. You implement what you can, you weasle your way around the things that will take too long. Those things are "out of scope" or "testing databases". You implement MFA while the auditor is auditing, but you know it breaks developers' workflows and there isn't a quick fix, so you turn MFA back off once the audit is complete....

TA-DA! We're ISO27001 certified! But we're no more secure than we were before.

> After publishing our story, Red Hat confirmed that the security incident was a breach of its GitLab instance used solely for Red Hat Consulting on consulting engagements, and not GitHub.

> While Red Hat did not respond to any further questions about the breach, the hackers told BleepingComputer that the intrusion occurred approximately two weeks ago.

"According to them, the created ticket was repeatedly assigned to additional people, including Red Hat's legal and security staff members."

Summarized: Given enough eyeballs, all extortion demands are fallow.

I sincerely hope that the game doesn’t become prophetic in the manner Idiocracy has.

Title needs updating