"The preliminary cause of the incident - the employee's
Posted: Sun Jan 26, 2025 9:51 am
There is also a risk that the direct effect could occur very quickly due to a boycott of Yandex products, primarily in foreign markets. "I wonder if Africans and their descendants suddenly start a campaign against Yandex for using a derogatory word in the code of their products and, as a result, the company's international income falls, could this be considered damage from a data leak, that is, directly related to information security?" asks the host of the blog "Business without danger" Alexey Lukatsky.
actions - is quite common, I canada cell phone number list would even say banal. Many organizations face threats from their staff. This is understandable: having access to data, it is easier to steal it than to try to hack it from the outside," Vladimir Ulyanov explains the nature of the incident at Yandex. "As for threats, substitution/theft depends on the implementation scenario, it is difficult to say in advance. In any case, publicity should play into the hands of security, the situation will not go unnoticed or quietly used by attackers. Apparently, security policies will be revised and organizational changes will be made, and the source code is already undergoing an internal audit."
"It is difficult to detect the emergence of dishonest employees, especially in such large companies. The only thing that can help against such large-scale leaks is the division of employee roles so that no one employee has full access to the entire source code repository," notes Daria Zubritskaya. "Most likely, the company has privileged users who have access to all components of the software. Both the access and behavior of such employees are poorly controlled. This is what allowed the insider to pump out such a volume of code."
Yandex itself sees the cause of the identified problems in the shortcomings of a number of company policies: "The company has had a Zero Bug Policy approach for a long time - a policy of zero tolerance for "bugs". The implementation of this approach in practice led to the fact that some "bugs" were corrected using temporary solutions that eliminated a specific problem or incorrect result of the algorithm. Yandex will retain the Zero Bug Policy, but the methods of implementation will be revised."
As InfoWatch monitoring shows , several incidents similar to the Yandex leak have occurred over the past three months. For example, the pharmaceutical company AstraZeneca stored real personal data of patients for over a year on the unprotected GitHub developer platform , which was openly accessible to anyone. The media company Thomson Reuters compromised three databases by placing them on an unprotected cloud server. The Chinese computer game developer miHoYo leaked a large amount of data on new game characters, quests, and events. The personal data of some developers was also disclosed.
actions - is quite common, I canada cell phone number list would even say banal. Many organizations face threats from their staff. This is understandable: having access to data, it is easier to steal it than to try to hack it from the outside," Vladimir Ulyanov explains the nature of the incident at Yandex. "As for threats, substitution/theft depends on the implementation scenario, it is difficult to say in advance. In any case, publicity should play into the hands of security, the situation will not go unnoticed or quietly used by attackers. Apparently, security policies will be revised and organizational changes will be made, and the source code is already undergoing an internal audit."
"It is difficult to detect the emergence of dishonest employees, especially in such large companies. The only thing that can help against such large-scale leaks is the division of employee roles so that no one employee has full access to the entire source code repository," notes Daria Zubritskaya. "Most likely, the company has privileged users who have access to all components of the software. Both the access and behavior of such employees are poorly controlled. This is what allowed the insider to pump out such a volume of code."
Yandex itself sees the cause of the identified problems in the shortcomings of a number of company policies: "The company has had a Zero Bug Policy approach for a long time - a policy of zero tolerance for "bugs". The implementation of this approach in practice led to the fact that some "bugs" were corrected using temporary solutions that eliminated a specific problem or incorrect result of the algorithm. Yandex will retain the Zero Bug Policy, but the methods of implementation will be revised."
As InfoWatch monitoring shows , several incidents similar to the Yandex leak have occurred over the past three months. For example, the pharmaceutical company AstraZeneca stored real personal data of patients for over a year on the unprotected GitHub developer platform , which was openly accessible to anyone. The media company Thomson Reuters compromised three databases by placing them on an unprotected cloud server. The Chinese computer game developer miHoYo leaked a large amount of data on new game characters, quests, and events. The personal data of some developers was also disclosed.