I got one for
TomServo
So again, I work in data infrastructure so this is more side drama to me. A few weeks ago a B2B sales guy comes to me and asks how we expose data in general. I said that that data platform itself is very much locked down. It does not export any of our internal data directly to anyone outside of certain services like a few financial ones we have. This guy was not really technical but he was very astute and he explains to me what he has been seeing.
In a several of his sales calls he said the potential customer knew far more than he thought they would about our sales process, final prices, and so on. I spend like 30 minutes showing him some of the inflows and outflows of this data, where it sits physically on our on prem systems and what consumes it. The primary consumer being the product application itself. The one that drives the entire business. He just goes okay, I will continue looking.
He goes to the app devs asking about it and this makes the rounds as the tech org is all seated in the same area of this startup type company. One that is doing ten times more business than it was 4 years ago and we have billions in revenue now. The app dev team finally asks this guy for some examples of what he suspects. Sure enough the customers are using datapoints that app dev says they should absolutely not have access to. Now we are forced on the hunt and to find it. Very easy to prove it can't be my space so we move on from that quickly.
Keep in mind we have exactly one dedicated infosec guy in the entire company and he is much more of a traditional IT systems infosec guy. He knows almost nothing about application architecture and security in general. The cause? Our internal only product was not nearly locked down as we thought (lol). The rotating key system that did indeed rotate internal access keys per session was actually exposing them in plaintext and the internal app itself not fully isolated from the greater internet. Leading to some of our customers figuring this out and scraping it constantly.
Our industry is highly transactional and volatile making this data very helpful when it comes to negotiating pricing and they knew what all of their competitors were paying. Overall a small sample of customers figured this out but still. LOL. The general philosophy was that the teams can handle their own infosec stuff. I bet we get a few hires for it now.