Class action lawsuits to follow...

We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named “Anonymous” with the words “We are Legion.”

The next blow, should it happen, could prove to be one of the worst public relations disasters to ever strike a consumer electronics company. Hackers say they have access to some of Sony's servers and plan to publicize all or some of the information they can copy from those servers. This may include consumers' credit card details. (A source tells CNET that this group of hackers claims to have access to Sony's servers, which are different from the servers already hacked to expose more than 77 million user accounts.)

Such private information would undoubtedly travel quickly around the world through torrents and download sites. Sadly, the vessel for this material would most likely be a simple text file, perhaps only 10MB-20MB in size. That may not sound like a large file, but in terms of pure text, its a bible's worth of names and numbers. Countless credit/debit cards would have to be replaced, and identities would have to be protected (for free, courtesy of Sony). Trust would be lost, perhaps never to be gained again.

I'm honestly surprised that Sony didn't take their entire company's network off the internet when they discovered the first breach.

Obviously this is a huge step to take but when your entire global reputation is on the line, huge steps have to be taken.

I think it was pretty naive of them to think that if their PSN got fucked over that something else was not in the pipe or already in the process of happening.

The problem with network security is that breaches of this scale are so uncommon that they are essentially a black swan.

Network ops get complacent because they just see the same bullshit all day, every day in the logs. From their perspective, a well planned attack is virtually impossible to predict or prepare for and indeed, a well planned attack would get through anyway, as this one did.

Maybe they should start teaching more network admins to get into network programming and developing their own applications, etc. instead of relying on third party software? Or is that generally what happens at the moment?

Be more diligent with who you give your fucking personal information to, especially when it's a multi-billion dollar corporation who likes to do shit like store all data collected from every user, ever, in a large server farm.

Maybe they should start teaching more network admins to get into network programming and developing their own applications, etc. instead of relying on third party software? Or is that generally what happens at the moment?

That's an Utopian ideology. These days, you cannot do anything that involves computers without divulging personal information. One could say that you simply shouldn't give up personal info like your name or address, but then you're opting out of so many services Internet provides that I don't think it's realistic to not give up some portion of your private info.

I'm not talking about putting your whole life on Facebook here, but something simple as placing an online order with your creditcard simply requires you to give up name and address info. And still, even the more diligent people would expect a large company like Sony to have their shit together, right? That may be naive, but compared to "www.bobs-second-hand-cars-and-assault-rifles.com" Sony should be a lot more worthy of that trust.