I was a senior VP of tech at Starwood: here’s my take on the guest data breach
This article seems full of points that a lay person might nod along with, yet don&#x27;t hold up to scrutiny.<p>&gt; The fact is, if we accept Marriott’s statement that the breach began in 2014, the system would already have been operating securely for five years.<p>It does not mean that. It means that we don&#x27;t know of any exploited vulnerabilities before that point.<p>&gt; If the detection tool was used prior to this September, why hadn’t the breach been detected earlier? And if the tool was not used earlier, how can they be so sure the breach occurred in 2014?<p>It isn&#x27;t unthinkable that the new tool alerted them to a problem, and during investigation discovered evidence that the vulnerability had been abused in the past.<p>&gt; It is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys.<p>Why? The argument seems to be: the primary encryption key is important, and thus will be most carefully guarded, so it is unthinkable that it would actually be exposed.<p>Ultimately the article strikes me as an article written by someone who has a beef with Marriott, and he ends noting that it&#x27;s possible that the breach occurred not due to issues with design, but due to the layoffs of Starwood&#x27;s technical staff.