Ok, here are just two items of recent history:
http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki... and https://www.schneier.com/blog/archives/2005/11/sonys_drm_roo...
In the days after the rootkits were exposed, Thomas Hesse, president of
Sony's global digital business, was quoted on NPR as saying, "Users don't
know what a rootkit is, so why should they care about it?"
http://en.wikipedia.org/wiki/PlayStation_Network_outage#Crit... Credit card data was encrypted, but Sony admitted that other user information
was not encrypted at the time of the intrusion.[44][58] The Daily Telegraph
reported that "If the provider stores passwords unencrypted, then it's very
easy for somebody else – not just an external attacker, but members of staff
or contractors working on Sony's site – to get access and discover those passwords,
potentially using them for nefarious means."[59] On May 2, Sony clarified the
"unencrypted" status of users' passwords, stating that:[60]
While the passwords that were stored were not “encrypted,” they were transformed
using a cryptographic hash function. There is a difference between these two types
of security measures which is why we said the passwords had not been encrypted.
But I want to be very clear that the passwords were not stored in our database in
cleartext form.
Bottom line is that Sony haven't helped themselves in the last few years. Whilst they build pretty good hardware, building software systems (especially to support things like the Playstation) isn't their forté. Worse is that when they do screw up, they are arrogant and disrespectful to their customers.
Their arrogance has irked a generation of hackers and script kiddies, who see Sony as a carte blanche target. The recent hack shows both their arrogance and negligent attitude to the security of their customer and private company data. Investors should be punishing Sony and calling for the heads of the board.
