5 ms·

Maybe I'm naive, but I'm hoping that the lawsuits from this will be the start of a push for data-breach insurance, and that the insurers, as Bruce Schneier has

Maybe I'm naive, but I'm hoping that the lawsuits from this will be the start of a push for data-breach insurance, and that the insurers, as Bruce Schneier has been advocating for many years, will force the security that the marketing VP doesn't see the need to pay for.

xlm1717 11y ago
Maybe you are naive, but you are certainly not as naive as the marketing VP who didn't see the need to pay for security, and is today watching in horror as his business is getting hacked to hell.
- siegecraft 11y ago
  Is this marketing VP a real person or just a hypothetical scenario? Because it doesn't make any sense to me that a marketing VP would have any decision making power about the need for security.
  - Kalium 11y ago
    In corporate life, what makes sense and what's true are sets that rarely overlap as much as you'd hope.
  - shaggyfrog 11y ago
    In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in slower logins, the development team could get immediate pushback to speed up the process, even at the risk of weaker security. Risk can be difficult to quantify, and if the focus is on chasing the short-term, you might be told to damn the torpedoes and get the product launched.
    - iofj 11y ago
      In every programmer's experience, security can have a disproportionate amount of influence. For instance, they are unwilling to do any real development, yet have the authority to demand their stuff be used. There is no reason any authentication process has to use more than a single request + single response (and a single request and immediate reply from the auth server). The usual concerns like replay attacks, allowing third parties to relay data for the auth server can all be solved using encryption. In 15 years of working as a developer, I have encountered one company that actually does this both correct and fast. Security departments demanding that user authentication happen over an LDAP+Kerberos connection, for example, are commonplace and this is stupid and very slow, for no good reason.
  - bduerst 11y ago
    Exactly. It's some vague personification here that doesn't make much sense. Who is this marketing VP who covers data breach insurance with their marketing budget? Now they're the ones making product decisions?
  - wanderfowl 11y ago
    Hypothetical here, but I can very easily picture a world in which the Marketing VP decides whether the programming team spends [amount of time] hardening/reducing customer data storage, or implementing some new whiz-bang feature they can put on the homepage.
- balls187 11y ago
  It seems weird that CIO type decisions would ever roll up to the Marketing VP. Having worked on a company that sold multifactor auth software in the mid 2000's, I can tell you most companies won't pay for software until there is a breach. This is not unlike home owners installing alarms until after a breakin has occured in the neighborhood.
nota_bene 11y ago
Could be that I'm naive as well, but personally, I hope that people will finally get the message Snowden tried to pass and in the process sacrificed his future (and maybe even his life) for: We're about to abandon our privacy.
- adevine 11y ago
  Yeah, it sucks, we'll have to go back to finding people to have affairs with the old fashioned way.
  - nota_bene 11y ago
    I'm not downvoting. I'm not pro-cheating either. People should have sexual freedom and be open about it with their partners, if they feel the need for it, to be happy. I see the need for privacy at all level of our lives. Unless we all make a democratic and informed choice to drop this value. But since this requires enormous maturity, society might be ready for this in a couple of hundred years.
  - btown 11y ago
    Just don't drive to their house, because when the cars get hacked and that data leaks...
victor9000 11y ago
do you have a link for the bit about the VP of Marketing?
- simcop2387 11y ago
  I think it's not a direct dig at AM but more at the attitude a lot of higher ups have had about these kinds of breaches[1]: "It’s a valid business decision to accept the risk” said Jason Spaltro, who is now Sony Pictures' senior vice president of information security, in the interview. “I will not invest $10 million to avoid a possible $1 million loss." [1] http://mashable.com/2014/12/05/sony-hack-infosec-comments/ http://mashable.com/2014/12/05/sony-hack-infosec-comments/
rayiner 11y ago
So far the settlements in data breach cases have been pretty small: http://fortune.com/2015/03/27/how-much-do-data-breaches-actually-cost-big-companies-shockingly-little http://fortune.com/2015/03/27/how-much-do-data-breaches-actu.... It's small enough where liability for even a huge breach would be pretty survivable for most companies.
skhatri11 11y ago
How would an insurance company price this risk?
- amyjess 11y ago
  I would imagine they'd come up with an algorithm to calculate the cost of lawsuits and lost business that would happen should an AM-magnitude leak occur.
tzs 11y ago
There may not be any lawsuits, other than in small claims courts. From their [terms and conditions](https://www.ashleymadison.com/app/public/tandc.p?c=1 https://www.ashleymadison.com/app/public/tandc.p?c=1) that you have to agree to: 19. ARBITRATION AND CLASS ACTION WAIVER .... D. Class and Consolidated Claims Waiver It is agreed that neither party shall have the right to participate as a class representative or class member with respect to any Disputes subject to arbitration under this Agreement or any Dispute between the parties. The parties also waive any right to assert consolidated claims with respect to any Disputes subject to arbitration under this Agreement or any Dispute between the parties. Such clauses are generally enforceable in the United States, as far as I can tell from a bit of Googling. It looks like in Canada, enforceability depends on whether the alleged misdeeds of the defendant arise from a violation of common law or a violation of specific consumer protection acts. The "Disputes subject to arbitration under this Agreement" seem to be set out in 19.A, which is titled "Scope", and the TL;DR of that section would be "everything, except Ashley Madison can use the courts instead of arbitration if they wish to sue you over intellectual properties, confidential information, or illegal activity". They do have one exception, given in 19.C, titled "Small Claims", which says: Both parties retain the right to file any claim that is not aggregated with the claim of any other persons and whose amount in controversy is properly within the jurisdiction of a court which is limited to adjudicated small claims.

xlm1717 11y ago

Maybe you are naive, but you are certainly not as naive as the marketing VP who didn't see the need to pay for security, and is today watching in horror as his business is getting hacked to hell.

siegecraft 11y ago
Is this marketing VP a real person or just a hypothetical scenario? Because it doesn't make any sense to me that a marketing VP would have any decision making power about the need for security.
- Kalium 11y ago
  In corporate life, what makes sense and what's true are sets that rarely overlap as much as you'd hope.
- shaggyfrog 11y ago
  In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in slower logins, the development team could get immediate pushback to speed up the process, even at the risk of weaker security. Risk can be difficult to quantify, and if the focus is on chasing the short-term, you might be told to damn the torpedoes and get the product launched.
  - iofj 11y ago
    In every programmer's experience, security can have a disproportionate amount of influence. For instance, they are unwilling to do any real development, yet have the authority to demand their stuff be used. There is no reason any authentication process has to use more than a single request + single response (and a single request and immediate reply from the auth server). The usual concerns like replay attacks, allowing third parties to relay data for the auth server can all be solved using encryption. In 15 years of working as a developer, I have encountered one company that actually does this both correct and fast. Security departments demanding that user authentication happen over an LDAP+Kerberos connection, for example, are commonplace and this is stupid and very slow, for no good reason.
- bduerst 11y ago
  Exactly. It's some vague personification here that doesn't make much sense. Who is this marketing VP who covers data breach insurance with their marketing budget? Now they're the ones making product decisions?
- wanderfowl 11y ago
  Hypothetical here, but I can very easily picture a world in which the Marketing VP decides whether the programming team spends [amount of time] hardening/reducing customer data storage, or implementing some new whiz-bang feature they can put on the homepage.
balls187 11y ago
It seems weird that CIO type decisions would ever roll up to the Marketing VP. Having worked on a company that sold multifactor auth software in the mid 2000's, I can tell you most companies won't pay for software until there is a breach. This is not unlike home owners installing alarms until after a breakin has occured in the neighborhood.

nota_bene 11y ago

Could be that I'm naive as well, but personally, I hope that people will finally get the message Snowden tried to pass and in the process sacrificed his future (and maybe even his life) for: We're about to abandon our privacy.

adevine 11y ago
Yeah, it sucks, we'll have to go back to finding people to have affairs with the old fashioned way.
- nota_bene 11y ago
  I'm not downvoting. I'm not pro-cheating either. People should have sexual freedom and be open about it with their partners, if they feel the need for it, to be happy. I see the need for privacy at all level of our lives. Unless we all make a democratic and informed choice to drop this value. But since this requires enormous maturity, society might be ready for this in a couple of hundred years.
- btown 11y ago
  Just don't drive to their house, because when the cars get hacked and that data leaks...

victor9000 11y ago

do you have a link for the bit about the VP of Marketing?

simcop2387 11y ago
I think it's not a direct dig at AM but more at the attitude a lot of higher ups have had about these kinds of breaches[1]: "It’s a valid business decision to accept the risk” said Jason Spaltro, who is now Sony Pictures' senior vice president of information security, in the interview. “I will not invest $10 million to avoid a possible $1 million loss." [1] http://mashable.com/2014/12/05/sony-hack-infosec-comments/ http://mashable.com/2014/12/05/sony-hack-infosec-comments/

rayiner 11y ago

So far the settlements in data breach cases have been pretty small: http://fortune.com/2015/03/27/how-much-do-data-breaches-actually-cost-big-companies-shockingly-little http://fortune.com/2015/03/27/how-much-do-data-breaches-actu.... It's small enough where liability for even a huge breach would be pretty survivable for most companies.

skhatri11 11y ago

How would an insurance company price this risk?

amyjess 11y ago
I would imagine they'd come up with an algorithm to calculate the cost of lawsuits and lost business that would happen should an AM-magnitude leak occur.

tzs 11y ago

There may not be any lawsuits, other than in small claims courts. From their [terms and conditions](https://www.ashleymadison.com/app/public/tandc.p?c=1 https://www.ashleymadison.com/app/public/tandc.p?c=1) that you have to agree to: 19. ARBITRATION AND CLASS ACTION WAIVER .... D. Class and Consolidated Claims Waiver It is agreed that neither party shall have the right to participate as a class representative or class member with respect to any Disputes subject to arbitration under this Agreement or any Dispute between the parties. The parties also waive any right to assert consolidated claims with respect to any Disputes subject to arbitration under this Agreement or any Dispute between the parties. Such clauses are generally enforceable in the United States, as far as I can tell from a bit of Googling. It looks like in Canada, enforceability depends on whether the alleged misdeeds of the defendant arise from a violation of common law or a violation of specific consumer protection acts. The "Disputes subject to arbitration under this Agreement" seem to be set out in 19.A, which is titled "Scope", and the TL;DR of that section would be "everything, except Ashley Madison can use the courts instead of arbitration if they wish to sue you over intellectual properties, confidential information, or illegal activity". They do have one exception, given in 19.C, titled "Small Claims", which says: Both parties retain the right to file any claim that is not aggregated with the claim of any other persons and whose amount in controversy is properly within the jurisdiction of a court which is limited to adjudicated small claims.