Rogue ex-Cisco employee who crippled WebEx conferences and cost Cisco millions gets two years in US prison A former Cisco employee who went medieval on his former employer and cost the company millions, has been sentenced to two years in prison and a $15,000 fine. Sudhish Kasaba Ramesh was employed by Switchzilla for less than two years but left in April 2018. Five months later he used access credentials to get back into Cisco's …
I can't agree more.
Sudhish Kasaba Ramesh may have gotten two years but Sudhish's managers, and the ones above them, needs to get fired.
I am not sure which icon to choose -- WTF or Fail because either one (or both) is really appropriate.
And all things considered, he got off pretty lightly too. The claimed damages to a great red-blooded American corporation is high compared to the punishment. I'd have expected the US justice system to have imposed at least two consecutive life sentences for that! :-)
It's criminal that the account was left open, and someone still in Cisco should be arrested for that negligence. It's not as if he was a criminal mastermind:
In a sentencing memorandum filed last week, federal prosecutors said Ramesh made little attempt to cover his tracks.“The government is perplexed on how the defendant — a highly intelligent individual — could have left a trail of bread crumbs that (led) the FBI to determine that he was responsible for the deletion of Cisco’s servers on AWS,” U.S. attorneys David L. Anderson, Hallie Hoffman and Susan Knight wrote in the memo. “He did not use a proxy internet service to hide his identity, registered his Google Cloud Platform account with his email address and American Express card and launched the attack from his work computer.”
An FBI agent who searched Ramesh’s work computer found Google searches for information on AWS servers and how to delete servers, which prosecutors said suggests that Ramesh “possibly did not realize that he was accessing a live production environment.”
https://www.bizjournals.com/sanjose/news/2020/12/09/former-cisco-engineer-prison.html
@Pascal Monett
"It's not because a door is open that you have the right to steal private property."
Indeed, but companies' claims for being secure are specious if they don't implement adequate cybersecurity measures, rather than treat fines as a cost of doing business.
For instance, the (onerous) GDPR penalties are paid by the negligent, not the hacker (who gets prison if caught), primarily to force companies to take security seriously.
He still had his account, remote access AND all his (deletion rights). The accounts & VMs can't have had easily restorable, TESTED backups. Yes, this guy was a tit & deserves jail time, but FFS in this age where we read a new breach every few days, aren't Cisco meant to be both providing solutions & advising how to secure networks???
Deserves jail time? Jail time should be reserved for those who are a danger to society, or where every other option has been exhausted. Some twonk who logged into a system they were not entitled to does not fall under that. 2 years is going to cost somewhere north of $100,000. Pointless waste of money.
Who could possibly have noticed? Cisco's malware has been a blight on the remote worker for over a decade. I remember having an old laptop, network isolated in the corner just for webex meetings forever ago. What could this sad sack have possibly done to make it worse or less secure. It is a POS that thankfully has been driven out to the margins. Apparently blackberry still use it. :)
> I remember having an old laptop, network isolated in the corner just for webex meetings forever ago
At my company all "remote" meetings are conference calls via POTS. The day that computer video calling is as easy as sending an email, and not less insecure, we'll talk.
Besides, seeing ugly faces of bored people on a screen kind of puts me in a worse mood than usual.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
