Update: Perhaps not, as Evisort dispute any customer data was exposed and they've updated security.

Every server ought to have a password. Every one.

It's 2019, and apparently that advice hasn't sunken in. I still can't believe there are people without passwords/codes on their mobile devices or home PCs, but there are. It's crazy, and while I can forgive some individuals for doing this, no IT infrastructure staff or developer ought to do this. And yet, a double fail recently from Evisort.

This is a startup doing some AI work, but apparently they set up an Elasticsearch server without a password. I've written about this before, and you set a password, but don't have to. That's both an Elasticsearch failure for not requiring one, but also a monumental failure on the part of whoever set this up inside a company.

Use. A. Password.

The second fail is with this server being claimed to be a "testing and development" server. If that's the case, why was production, live data on it? I know many people do this, but if you use that data in non production environments, the data needs to be secured. I'm sure it's especially hard for AI/ML systems to work without real data, unlike other database driven applications, but if you need live data, you need real security here.

If you don't want to do this, then you need masked, obfuscated, pseudonymized, generated, or other data that can be used. I've realized the problems and scope of this across the last few years in my work with Redgate customers, while looking at the challenges and problems brought about by using this data. We've also see there is a lot of potential liability with new regulations like the GDPR and the CCPA for poor data security.

I used to worry about the state of our industry with the poor quality of so many applications written in the 80s and 90s. Now I worry even more about the problems of poor data security. I don't have good answers, but I know we need to do better.