4 ms·

As much as I would like to see this, without a stable industry consensus on best practices, there is insufficient foundation for a legal definition of negligenc

As much as I would like to see this, without a stable industry consensus on best practices, there is insufficient foundation for a legal definition of negligence.

Silhouette 16y ago
An alternative possibility is that evidence of "reasonable" behaviour would be heard on a case by case basis in court, and case law would start to show the minimum standards expected. Some practices may be more hype than substance, and anyone alleging a problem because something was not done would presumably have to justify why that action should have been taken. On the other hand, I think you would find a lot of consensus and evidence-based argument in some areas of security, and there is really no excuse for not following those practices if you're in the business of managing sensitive data.
- extension 16y ago
  If we are going to shift responsibility from attackers to the attacked, there needs to be a clear and reasonable way for security non-experts to ensure that they are doing their due diligence, and for non-experts in the legal system to be confident that they aren't. For now, any clown can come along and tell someone that they are secure, and another clown can verify that the first clown is an official certified non-clown. It may be perfectly obvious to you that these people are incompetent, but to the non-expert it ultimately comes down to your word vs theirs. Even the clowns may not have an objective way of knowing that they are clowns. Without an authoritative standard that provides a root of trust to non-experts, everything falls apart. That standard requires consensus, which requires a critical mass of competent experts, which requires the state of the art to keep up with demand and change, which is not going to happen in the field of security any time soon because there is too much demand, too much change, and it's just too damn hard.
  - Silhouette 16y ago
    > If we are going to shift responsibility from attackers to the attacked, there needs to be a clear and reasonable way for security non-experts to ensure that they are doing their due diligence, and for non-experts in the legal system to be confident that they aren't. I'm sorry, but I don't entirely agree with that. I think if you deliberately take on a role that is potentially damaging to others, such as collecting large quantities of personal data, then to some extent the onus has to be on you to be competent in how you protect that data. The whole premise of using words like "reasonable" in statutes and then developing case law over time is that you can't always predict every single possibility in complete detail ahead of time, and sometimes you have to make a judgement in the circumstances of a particular case about whether someone's actions were reasonable. This problem isn't specific to IT security, of course. After all, any time you employ a new member of staff as a company, you are to some extent trusting that they (and perhaps their references) have been honest in their representations to you during the recruitment process. And yet, we still have businesses with employees, even though it is an uncertain world, and for the most part this works fine anyway. > Without an authoritative standard that provides a root of trust to non-experts, everything falls apart. I respectfully disagree. It doesn't take a big, formal spec to understand that you should hold sensitive information behind a secure access mechanism, and that sensitive data should be protected to avoid leaks in transit or on disposal of hardware. If someone doesn't understand and follow these basic principles, then perhaps handling sensitive data is not a good career choice for them or their business. I would have no problem with a legal action against an organisation that compromised, say, many people's bank credentials, by leaving them on an unencrypted USB stick on a train. Arguing about whether a certain state-of-the-art or controversial security process or tool was necessary and whether failing to use such a thing was negligent is for courts to consider, based on the testimony and possibly expert statements from both sides. If anything, this process and a reasonable burden of proof on the prosecution seem more sensible to me than trying to reduce a fast-moving field like IT security to a fixed checklist that might be obsolete within days of completion.
    - extension 16y ago
      The things you describe are reasonable in general, but break down under the extremes of present day security, software development too. The problem is that most people who think they can do it, can't. That is, most professionals will take on more challenging problems than they are practically qualified for. If the bulk of an industry can't judge its own competence, customers and courts have no chance of doing so. And yet this is increasingly a requirement for doing business at all. You can't simply tell people to stop using computers. If you can't define "reasonable" for the purposes of writing a law, it's a good indication that people won't know what it means when they try to obey the law. You can't make laws that nobody knows how to follow.

As much as I would like to see this, without a stable industry consensus on best practices, there is insufficient foundation for a legal definition of negligence.

Silhouette 16y ago

An alternative possibility is that evidence of "reasonable" behaviour would be heard on a case by case basis in court, and case law would start to show the minimum standards expected. Some practices may be more hype than substance, and anyone alleging a problem because something was not done would presumably have to justify why that action should have been taken. On the other hand, I think you would find a lot of consensus and evidence-based argument in some areas of security, and there is really no excuse for not following those practices if you're in the business of managing sensitive data.

extension 16y ago
If we are going to shift responsibility from attackers to the attacked, there needs to be a clear and reasonable way for security non-experts to ensure that they are doing their due diligence, and for non-experts in the legal system to be confident that they aren't. For now, any clown can come along and tell someone that they are secure, and another clown can verify that the first clown is an official certified non-clown. It may be perfectly obvious to you that these people are incompetent, but to the non-expert it ultimately comes down to your word vs theirs. Even the clowns may not have an objective way of knowing that they are clowns. Without an authoritative standard that provides a root of trust to non-experts, everything falls apart. That standard requires consensus, which requires a critical mass of competent experts, which requires the state of the art to keep up with demand and change, which is not going to happen in the field of security any time soon because there is too much demand, too much change, and it's just too damn hard.
- Silhouette 16y ago
  > If we are going to shift responsibility from attackers to the attacked, there needs to be a clear and reasonable way for security non-experts to ensure that they are doing their due diligence, and for non-experts in the legal system to be confident that they aren't. I'm sorry, but I don't entirely agree with that. I think if you deliberately take on a role that is potentially damaging to others, such as collecting large quantities of personal data, then to some extent the onus has to be on you to be competent in how you protect that data. The whole premise of using words like "reasonable" in statutes and then developing case law over time is that you can't always predict every single possibility in complete detail ahead of time, and sometimes you have to make a judgement in the circumstances of a particular case about whether someone's actions were reasonable. This problem isn't specific to IT security, of course. After all, any time you employ a new member of staff as a company, you are to some extent trusting that they (and perhaps their references) have been honest in their representations to you during the recruitment process. And yet, we still have businesses with employees, even though it is an uncertain world, and for the most part this works fine anyway. > Without an authoritative standard that provides a root of trust to non-experts, everything falls apart. I respectfully disagree. It doesn't take a big, formal spec to understand that you should hold sensitive information behind a secure access mechanism, and that sensitive data should be protected to avoid leaks in transit or on disposal of hardware. If someone doesn't understand and follow these basic principles, then perhaps handling sensitive data is not a good career choice for them or their business. I would have no problem with a legal action against an organisation that compromised, say, many people's bank credentials, by leaving them on an unencrypted USB stick on a train. Arguing about whether a certain state-of-the-art or controversial security process or tool was necessary and whether failing to use such a thing was negligent is for courts to consider, based on the testimony and possibly expert statements from both sides. If anything, this process and a reasonable burden of proof on the prosecution seem more sensible to me than trying to reduce a fast-moving field like IT security to a fixed checklist that might be obsolete within days of completion.
  - extension 16y ago
    The things you describe are reasonable in general, but break down under the extremes of present day security, software development too. The problem is that most people who think they can do it, can't. That is, most professionals will take on more challenging problems than they are practically qualified for. If the bulk of an industry can't judge its own competence, customers and courts have no chance of doing so. And yet this is increasingly a requirement for doing business at all. You can't simply tell people to stop using computers. If you can't define "reasonable" for the purposes of writing a law, it's a good indication that people won't know what it means when they try to obey the law. You can't make laws that nobody knows how to follow.