So he finds that USC has deployed vulnerable web code, and they take their site down to fix it, and he is responsible for the downtime of the website?

Let's see, we wouldn't want to blame the web programmer for writing insecure code. Or the USC Information Security Team for allowing the code to be put into production on an Internet-facing web server. Seems to me that a bunch of incompetent IT people are trying to shift blame off of themselves.

Since USC has shifted the blame so efficiently, I'm sure that the same sloppy code is likely being deployed on other parts of their network. However, since we know how they treat an honest person who wants to cooperate with them, next time it won't be an honest person who is looking for the flaw(s). USC students beware! Your personal data is likely at risk and the only people looking for it are going to misuse it when they find it.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11389/33750#33750