Abandon4093 said:
You can't make a law out of quality. Aslong as they say they put their best team on the job but simply couldn't uncover things until after the fact they're covered.
..that's what they /say/. Like I tried, vainly, to explain - how does that excuse them from the law? It doesn't.
And you're not thinking about it properly. Consider how large their database is compared to your average online shop. How many trails the hackers will have left stumbling through it. It could take months to fully asses what happened. It's not like there's a 'Tell you exactly what the hackers took' program that they can just execute and get an answer 2 minutes later.
..yes.. it's not like in the movies, you know. Systemic process, linear progression, no secret switches. Half of it is knowing the systems already, and exploiting known ways to exploit bad architecture. Finding ways around systems typically means finding weaknesses and then planning something on beforehand - if it doesn't work, back to the drawing board. It sure would be awesome if hacking something looked like navigating the ether as a technomage, or something. But it doesn't.
The flip-side to that, is designing a database well. This includes knowing which parts are accessible with what privileges and from where. And yes, it would normally take you three seconds to figure out what parts of a database would be affected. Because you would know what parts of the system would be accessible, and how the system was breached, etc.
