In this commentary, the speaker outlines a security breach involving Deloitte's marketing website for a 2015 "Test Your Hacker IQ" event, where a researcher exposed participant usernames and passwords. The incident is portrayed as an embarrassment for a firm that advises on cybersecurity, underscoring that trust is the core currency in the security consulting industry. The speaker extracts four practical lessons: (1) marketing teams should never control security and must be excluded from security decisions; (2) vendor contracts must embed security and privacy requirements with proper oversight, especially for non‑security agencies; (3) organizations need robust data lifecycle management, including timely decommissioning and secure destruction of obsolete systems and data; and (4) firms should consider external security audits or advocates to maintain consistent security posture. The overall message warns that failures in these areas erode reputation and jeopardize the premium consulting business model.
Chapters
Well, this is embarrassing. Deloitte, one of the big consultancy firms out there, had a website to be able to test people's hacker IQ. Well, a security vulnerability researcher went in and found the, the website itself was vulnerable and was able to expose the username and passwords of the people participating. So it's a little embarrassing, uh, especially for a big consultancy firm that consults for cybersecurity. Now, this particular website was tied to an event dating back to 2015, and Deloitte has come out very quickly and shut the website down and said this website was through a separate company, a marketing company, and it didn't really have any access to Deloitte's main infrastructure and files and customers. Okay, great. But it still is a black eye. It still is an embarrassment, because if you're a new client or somebody looking for a consultancy firm, You read this story and go, wait a second, do I really want to throw down buckets of money for an organization that can't even keep their own house clean? Well, that's a problem. I mean, the reality is, in the security industry, trust is the currency. So there's some important lessons here to learn, right? First off, never ever let marketing be in charge of security. In fact, they shouldn't even be in the room. Right? They have completely different objectives. It's just a red flag anytime marketing groups or agencies are going to be tied into security. There needs to be oversight. And that leads kind of into the next key learning is vendors, right? When you're hiring vendors, you need to make sure you've got security and privacy aspects embedded into the contract. There needs to be oversight, especially for marketing-type firms they don't specialize in security, right? And if they are doing something that's insecure and it gets found out, that currency that you have, that trust, then goes down. It's your name, your reputation on the line. So you better choose your vendors carefully. You better put the proper controls in and the right oversight. And this leads into the next kind of key learning, which this site was created for an event in 2015. What is it still doing alive, right? Data and systems, when they're no longer useful, become caustic. They are a liability. Shut them down. Delete data. Remove them. It's easier just to ignore it, yes, but you have— as part of the due diligence and due care, you have to go in and complete that lifecycle from birth to death. Get rid of old data, get rid and remove old systems that are no longer valuable, that are no longer being used. It's very important. And it's not just with contests or anything. It's really something that needs to be embedded in entire organizations, right? You should have a data destruction policy, how long data should live and how it should be destroyed and how it gets validated and audited. And again, very important, even with those vendors that you deal with. Now, lastly, again, security's— the currency of security is that trust. So you have to have the right oversight for anything internal, external. Your reputation's on the line and you have to take it seriously because reputation, especially in the consulting industry, well, that's really what your anchor is. That's what allows you to go out with and compete and charge decent amounts of money. If people don't trust that, if people see that you can't even keep simple things taken care of, secure, and private, that undermines that trust. It undermines your position. And maybe Deloitte should be thinking about hiring some external security experts and advocates to make sure that they are keeping up with their security consistency and accuracy. Something to think about.
