OPINION: If ever some advice of mine was both timely and much needed, then a piece of mine for IT Pro from 13 May entitled 'Why enterprises need a data breach response plan' has to be it.
The conclusion to that piece would certainly have provided eBay HQ with some food for thought, particularly in light of recent events.
It stated: "A proper response plan enables the enterprise to mitigate the breach, to minimise the damage done and reduce the potential reward to the bad guys. It may not be a win-win, but it's as close as you are realistically going to get." Sadly, eBay never came close; not by a country mile.
The breach itself appears to have gone undetected for two months, which is unacceptable for any enterprise, but when the business is as big as eBay it's unforgivable.
Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.
To make matters worse, it then took eBay a further two weeks from being made aware of the breach to disclose details about it. This is not uncommon, and as a rule of thumb the excuse for the delay will be so as 'not to hamper any investigation'.
This is all bad enough, but once that disclosure was made it was done through a blog post and media interviews. Users were not notified by email, and there were no messages even within the internal mailing system warning customers to change their passwords.
Despite assurances to the media that password change notifications would be going out, nothing was forthcoming.
As my own investigation uncovered, the only mention of the breach on eBay, and the only advice to reset passwords, was to be found on the change password screen itself.
This is where users end up if they are already in the process of changing the password for whatever reason, which strikes me as particularly bizarre.
Then, when users did try and change their passwords, the system fell over. Aha, you may say, that's why they didn't warn folks, because eBay knew the servers would go down under the strain.
My response to that? eBay can afford to get extra resources in place, and in double-quick time, to ensure no such thing happened.
My attempt to change my password was met with a message telling me I'd succeeded, but then it wouldn't allow me to use it afterwards and told me I should go knit a jumper instead.
Well, maybe not in those exact words. It took a number of days before my password was successfully changed and my account was secured once more.
If eBay had any kind of half-decent breach response plan in place, and if it really cared about customer security (rather than the immediate bottom line), then it would have just reset every single password.
That would protect the accounts at risk and force all users to change when they next logged in.
It also wouldn't hurt if, like so many other giants of the internet world, eBay had some form of two-factor authentication in place, but it hasn't. At least not in the UK, as far as I can tell.
And finally, as I must stop ranting or my head is going to blow, there's the small matter of the really poor 'strength meter' you get when changing your password. This is as broke as your average homeless guy.
Whoever was employed at eBay to manage security response quite obviously failed to manage anything other than striking a hammer blow to the company's reputation.
Stick a 20 random character string in there, comprising of four upper, four lower, four symbols, four numbers and two of anything you like, and you might think that would get a strong rating. But no, it's only medium, apparently.
On what planet? Oh, the same planet where a seven character string with one uppercase letter shows as being more secure than a 12 string combination of nine random lowercase letters and three random numbers, I guess.
eBay Australia even gave advice that a good and secure password might be $uperman1963 or bestjetpilot. Jeez! Ignore those strength meters, they are almost all as good as useless. Which is a coincidence, because so is the eBay breach response management team.
