Sage Pastel security flaw uncovered, problem being addressed

[jes]

Sage Pastel security flaw uncovered, problem being addressed

Sage Pastel Accounting and Sage Pastel Payroll & HR are taking immediate action to address a security issue with their internal processes

 

[callisto]

This guy wants a quick buck. Remember the guy who registered MikeRoweSoft.com and wanted thousands of dollars?

Who would like to bet that he has some personal motive here? Offering 'secure service' for RRR per month?

 

[mister]

This guy just wants a quick buck. Remember the guy who registered MikeRoweSoft.com and wanted thousands of dollars?

Pfft. They deserve to be fined for this kind of incompetence.

 

[RichardG]

Such stuff should be hosted internally within the organization without internet access! Very sensitive data like this available on the open market can be sold for thousands to their competitors etc

 

[mister]

Such stuff should be hosted internally within the organization without internet access! Very sensitive data like this available on the open market can be sold for thousands to their competitors etc

It was INCREDIBLY negligent, and I imagine there could be legal ramifications...

 

[MagicDude4Eva]

Don't need to be super clever to find this (Google helps - site:xxxx inurl:xxx) - companies negligent like that will very soon be fined under POPI. As a customer I would have instituted civil action.

Reporting is not great, as it is not a security flaw, but negligence to provide customers a public accessible FTP server to dump sensitive customer data. Wondering if FTP access has been logged and Pastel will actually take action against unauthorised access.

 

[HavocXphere]

Such stuff should be hosted internally within the organization without internet access! Very sensitive data like this available on the open market can be sold for thousands to their competitors etc

Nope. Its technically the "correct" answer, but trust me...in practice outsourcing it to Sage works out 100% better. For small / medium companies its either outsource it to Sage (which is OKish) or have the in-house IT have a shot at custom rolling a deployment. The later is *always* a complete and utter fck-up. Always.

Imagine the average finance guy...now give him a compiler, access to a cloud solution, a credit card and tell him to implement an IT solution. Complete f-up, right? Its much the same the other way round...IT guys can't see how much they fail at finance solutions...

Also...Sage is one of the "better" companies out there...don't be too harsh.