3 ms·

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in sof

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

kahnjw 9y ago
You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy. Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked, whatever, just a few hundred million customers data exposed to identity fraud. It takes a chunk out of Equifax stock but they'll probably survive. What is the incentive for congress to enact laws regulating corporate handling of consumer data? Put it this way. Who do you think is louder in Washington: consumer advocacy groups or corporate lobbyists?
- KGIII 9y ago
  I'm not sure they actually care in Washington. I was impacted by the OPM breech. I got a form letter and some credit monitoring. All that outrage and, as near as I can tell, not a damned thing has changed. I might be biased and jaded.
  - kahnjw 9y ago
    Thats exactly what I'm saying. There is near zero incentive for congress to enact consumer protection legislation.
    - chiefalchemist 9y ago
      There's incentive (as it's their job, or is said to be). What there isn't is a downside if they don't.
      - kahnjw 9y ago
        If we're talking about economic incentive, having no downside for not doing thing A is equivalent to having no incentive to do thing A. Re: opportunity cost.
        chiefalchemist 9y ago
        Yes. In economics that's the context. But in terms of civics, I think the term is: voter apathy.
    - KGIII 9y ago
      I was adding to, not arguing with.
    - notfromhere 9y ago
      especially when they're trying to dismantle what little we have (CFPB)
- deleted 9y ago
  [deleted]
- g051051 9y ago
  > What is the incentive for congress to enact laws regulating corporate handling of consumer data? The already did, it's called the Gramm–Leach–Bliley Act: > In terms of compliance, the key rules under the Act include The Financial Privacy Rule which governs the collection and disclosure of customers' personal financial information by financial institutions. It also applies to companies, regardless of whether they are financial institutions, who receive such information. The Safeguards Rule requires all financial institutions to design, implement and maintain safeguards to protect customer information. The Safeguards Rule applies not only to financial institutions that collect information from their own customers, but also to financial institutions – such as credit reporting agencies, appraisers, and mortgage brokers – that receive customer information from other financial institutions. Note the inclusion of CRAs.
  - kahnjw 9y ago
    GLBA was enacted in the 90s and is a vague set of guidelines for financial and related industries to follow. I'm talking about real system regulation, down to the level of protocols.
snarf21 9y ago
So true, keep your head down and wait for your bonus. Everyone in middle management is too busy with self preservation to bother doing what's best for the company.
drawkbox 9y ago
It is sometimes a maddening fight to get software quality shipped and not ship a maintenance nightmare in certain orgs. This especially depends on if the company is engineering led or more bizdev/mba led or how much the latter values engineering. Equifax is a business that is not engineering led today and probably will never be as it is a credit agency and not consumer focused. For a company that has been around since 1899 and through many technological changes, they should have really focused more on cyber security in this age. Then again, Equifax is not a consumer company, they are a credit agency and only answer to their customers that probably don't value spending on securing personal data as the ones that are accessing Equifax want that data. The question is, should a company that doesn't care (nor their stakeholders) about securing data as a way they make their money, should they be in control of all that data?
alexasmyths 9y ago
To be fair, it's not 'technical competency' but rather a broad range of operational, process, product and engineering competencies. Also, a lot of companies just don't have a thoughtful process for this. Think of how much data Google and FB have, and they've never been breached. As much as I loathe them, I actually feel more 'secure' with the data that is supposed to be secure with FB than with my local bank. FB depends on talent, banks depend on thick process, regulation and massive risk aversion. Equifax depends on mediocre eng, product, ops etc..
- kahnjw 9y ago
  >they've never been breached HA HA HA HA HA HA lksahdgiua bregil nAG HA HA HA HAH! http://www.reuters.com/article/net-us-facebook-security/facebook-admits-year-long-data-breach-exposed-6-million-users-idUSBRE95K18Y20130621 http://www.reuters.com/article/net-us-facebook-security/face...
- kahnjw 9y ago
  HAHAHAHAHAHAHHA https://www.theguardian.com/technology/2017/jun/16/facebook-moderators-identity-exposed-terrorist-groups https://www.theguardian.com/technology/2017/jun/16/facebook-...
- Boothroid 9y ago
  If they have any sense they should outsource the whole thing.
mbesto 9y ago
The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...
- wil421 9y ago
  Since when is 3 billion dollars in revenue not serious money?
  - Pxtl 9y ago
    Because they don't lose any of it for the breach. Market value will bounce right back. The company will merrily chug along like nothing happened and collectively the industry will go on working with Equifax because who else will they use?
  - kahnjw 9y ago
    Have you heard the term moral hazard?
  - mbesto 9y ago
    Because you and I do NOT pay for or directly use the product that contributes to the $3B. I can buy a phone and still avoid Apple. I can use the web and still avoid Google. I can avoid Facebook altogether (some argument as to wether I can actually avoid this). But if I want to use a credit card, buy a house, etc. I cannot escape Equifax.
    - wil421 9y ago
      Thanks. I understand your point now. It's money that will motivate congress but in reality the Equifax breach is more impactful to you or me.
- kahnjw 9y ago
  Exactly. And congress can fix it.
- wwweston 9y ago

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

kahnjw 9y ago

You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy. Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked, whatever, just a few hundred million customers data exposed to identity fraud. It takes a chunk out of Equifax stock but they'll probably survive. What is the incentive for congress to enact laws regulating corporate handling of consumer data? Put it this way. Who do you think is louder in Washington: consumer advocacy groups or corporate lobbyists?

KGIII 9y ago
I'm not sure they actually care in Washington. I was impacted by the OPM breech. I got a form letter and some credit monitoring. All that outrage and, as near as I can tell, not a damned thing has changed. I might be biased and jaded.
- kahnjw 9y ago
  Thats exactly what I'm saying. There is near zero incentive for congress to enact consumer protection legislation.
  - chiefalchemist 9y ago
    There's incentive (as it's their job, or is said to be). What there isn't is a downside if they don't.
    - kahnjw 9y ago
      If we're talking about economic incentive, having no downside for not doing thing A is equivalent to having no incentive to do thing A. Re: opportunity cost.
      - chiefalchemist 9y ago
        Yes. In economics that's the context. But in terms of civics, I think the term is: voter apathy.
  - KGIII 9y ago
    I was adding to, not arguing with.
  - notfromhere 9y ago
    especially when they're trying to dismantle what little we have (CFPB)
deleted 9y ago
[deleted]
g051051 9y ago
> What is the incentive for congress to enact laws regulating corporate handling of consumer data? The already did, it's called the Gramm–Leach–Bliley Act: > In terms of compliance, the key rules under the Act include The Financial Privacy Rule which governs the collection and disclosure of customers' personal financial information by financial institutions. It also applies to companies, regardless of whether they are financial institutions, who receive such information. The Safeguards Rule requires all financial institutions to design, implement and maintain safeguards to protect customer information. The Safeguards Rule applies not only to financial institutions that collect information from their own customers, but also to financial institutions – such as credit reporting agencies, appraisers, and mortgage brokers – that receive customer information from other financial institutions. Note the inclusion of CRAs.
- kahnjw 9y ago
  GLBA was enacted in the 90s and is a vague set of guidelines for financial and related industries to follow. I'm talking about real system regulation, down to the level of protocols.

snarf21 9y ago

So true, keep your head down and wait for your bonus. Everyone in middle management is too busy with self preservation to bother doing what's best for the company.

drawkbox 9y ago

It is sometimes a maddening fight to get software quality shipped and not ship a maintenance nightmare in certain orgs. This especially depends on if the company is engineering led or more bizdev/mba led or how much the latter values engineering. Equifax is a business that is not engineering led today and probably will never be as it is a credit agency and not consumer focused. For a company that has been around since 1899 and through many technological changes, they should have really focused more on cyber security in this age. Then again, Equifax is not a consumer company, they are a credit agency and only answer to their customers that probably don't value spending on securing personal data as the ones that are accessing Equifax want that data. The question is, should a company that doesn't care (nor their stakeholders) about securing data as a way they make their money, should they be in control of all that data?

alexasmyths 9y ago

To be fair, it's not 'technical competency' but rather a broad range of operational, process, product and engineering competencies. Also, a lot of companies just don't have a thoughtful process for this. Think of how much data Google and FB have, and they've never been breached. As much as I loathe them, I actually feel more 'secure' with the data that is supposed to be secure with FB than with my local bank. FB depends on talent, banks depend on thick process, regulation and massive risk aversion. Equifax depends on mediocre eng, product, ops etc..

kahnjw 9y ago
>they've never been breached HA HA HA HA HA HA lksahdgiua bregil nAG HA HA HA HAH! http://www.reuters.com/article/net-us-facebook-security/facebook-admits-year-long-data-breach-exposed-6-million-users-idUSBRE95K18Y20130621 http://www.reuters.com/article/net-us-facebook-security/face...
kahnjw 9y ago
HAHAHAHAHAHAHHA https://www.theguardian.com/technology/2017/jun/16/facebook-moderators-identity-exposed-terrorist-groups https://www.theguardian.com/technology/2017/jun/16/facebook-...
Boothroid 9y ago
If they have any sense they should outsource the whole thing.

mbesto 9y ago

The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...

wil421 9y ago
Since when is 3 billion dollars in revenue not serious money?
- Pxtl 9y ago
  Because they don't lose any of it for the breach. Market value will bounce right back. The company will merrily chug along like nothing happened and collectively the industry will go on working with Equifax because who else will they use?
- kahnjw 9y ago
  Have you heard the term moral hazard?
- mbesto 9y ago
  Because you and I do NOT pay for or directly use the product that contributes to the $3B. I can buy a phone and still avoid Apple. I can use the web and still avoid Google. I can avoid Facebook altogether (some argument as to wether I can actually avoid this). But if I want to use a credit card, buy a house, etc. I cannot escape Equifax.
  - wil421 9y ago
    Thanks. I understand your point now. It's money that will motivate congress but in reality the Equifax breach is more impactful to you or me.
kahnjw 9y ago
Exactly. And congress can fix it.
wwweston 9y ago