https://www.bbc.co.uk/news/business-51760510
"A Virgin Media database containing the personal details of 900,000 people was left unsecured and accessible online for 10 months, the company has admitted."
The breach was not due to a hack or a criminal attack, but because the database had been "incorrectly configured" by a member of staff not following the correct procedures, Virgin Media said.
Which shows yet again people still don't get that digital security is not about giving people enormous power and writing a policy and process document that basically says thou shalt not f**k up.
A database does not spend 10 months unsecured because it was "incorrectly configured". It gets to spend 10 months unsecured becasuse a) your 'process' allowed the mistake to be made in the first place and didn't have enough automated and human checking and b) more importantly because someone didn't have effective monitoring and regular scanning of their assets in place to catch the problem later and sound the alarm.
An industrial site does not get burgled "because someone left the window opened for 10 months", it gets burgled because someone didn't have their security doing basic commonsense daily checks and closing it". Ditto in digital space.
