Phil Lieberman makes a statement on the Sony PlayStation security breach

“Taking a baseball bat to a hornet’s nest is never an advisable strategy.  Sony’s strategy in defending its intellectual property was heavy handed and has triggered the “nuclear option” with those that it engaged.  Perhaps Sony could learn a few lessons from Microsoft in how it has handled XBOX 360 and Kinect intellectual property.

My suggestions for consumers:

1) Don’t provide your correct DOB or other personal information to this type of vendor (i.e. playing games on-line)

2) Use a throw away email account

3) Use an anonymous debit card for these types of on-line transactions

4) Use a unique password per site

5) Always assume that the company gathering your personal information in totally incompetent at securing the data, and consider what you share with them and how you are going to recover your personal identity after they lose your information.

The reality of cloud data security and PCI today are that they are ineffective and there are no consequences for many companies that under-invest in security.  You can be sure that the CIO and CSO at Sony responsible for this situation will probably not be fired or held accountable for their poor decisions.  Similarly, the auditor responsible for the Sony account will similarly (in all probability and looking at these situations historically) not be held accountable.  The loss of your personal information will (mot likely) be nothing more than a “cost of doing business” for this type of company-you will take the pain and they will take a hit to their reputation (maybe).

It is for this reason we are fundamentally opposed to hiding PCI results as well as SAS70 reports from the public.  If you don’t have access to the full internal security report of a vendor you are dealing with, you should expect that they have little to no real security and that your data will probably be compromised.

There is abundant technology to prevent this breach and/or limit its scope, but Sony chose to not implement it.    Putting this much data in a single database that is publicly extractable with no limits is shameful given what is available today to protect against this type of loss.

In the case of Sony, we have a situation where they created their own emotionally motivated attacker and failed to protect themselves sufficiently.  In general, attacks are for financial gain rather than for personal revenge.”

- Phil Lieberman, CEO, Lieberman Software, Los Angeles (www.liebsoft.com)