3 ms·

I read what you wrote as affirming my thought. The constraints of DoD CSI, DO-178B, and the smart card industry focus are all embodied in regulations, which pr

I read what you wrote as affirming my thought. The constraints of DoD CSI, DO-178B, and the smart card industry focus are all embodied in regulations, which precede legal retribution. If a company busts the regs, it can be sued. But the first line of defense is that companies are required to do it right - by the regulations. I agree regulation needs clear definition and followup to be effective. I continue to regard regulation as a better mitigator of damage than post-hoc penalties. Regulation is about preventing a mess. Litigation is about cleaning it up. I'd rather not have the mess to begin with.

nickpsecurity 10y ago
"Regulation is about preventing a mess. Litigation is about cleaning it up. I'd rather not have the mess to begin with." That's exactly it. Although, I did propose possibility in this thread of defining regulations that aren't immediately applied but apply in court after harm is alleged. The reason being evaluation costs and time can be a big problem, esp for startups. This lets them simply follow guidelines with evidence produced during development & they only pay the cost if they screw up. The cost goes up with level of deviation and harm it caused.