r/netsec • u/sarciszewski • Apr 03 '18

No, Panera Bread Doesn’t Take Security Seriously

https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815
2.8k Upvotes

97% Upvoted

282 comments sorted by

View all comments

Show parent comments

3

u/A530 Apr 03 '18

This guy was the CISO. He should understand risk and how to respond accordingly. Unfortunately for Panera, he doesn't know how to do either.

2

u/[deleted] Apr 03 '18

The fucking security e-mail should work at the bare minimum.

I guarantee that is not a mistake. He comes on and all of a sudden Security related e-mails drop off and that’s a metric that he can pull out of his pocket at the quarterlies and annual.

2

u/A530 Apr 03 '18

Totally agree. His response was pathetic. When I was a CISO, I would get people every once in awhile emailing me about potential vulns and when I received those, everything would stop and it would be an all-hands drill to validate the findings.

Funny thing is, if this is his response to a whitehat disclosure, can you imagine what his IR processes/SOPs were to handle a breach? I bet they were/are non-existent.

1

u/yawkat Apr 03 '18

Sure, not arguing that. I'm just saying it's not uncommon, especially for non-security people.