4 ms·

> Specifically, these folks point out that patching is hard. The gist of these points is that you can’t expect a major corporation to rapidly deploy something

by rdtsc 9y ago

> Specifically, these folks point out that patching is hard. The gist of these points is that you can’t expect a major corporation to rapidly deploy something as complex Then they should be taken to court and be forced to pay for it. It's like saying about a company which runs trains and didn't do maintenance which caused an accident to happen "Well, you see maintaining the brakes on the trains is too hard so don't blame them too much...". > The gist of these points is that you can’t expect a major corporation to rapidly deploy something as complex as a major framework patch across their production systems. So those corporations will be hacked, and then they should be dragged to court, made to pay, some might even go bankrupt and disappear altogether. Eventually only the companies that manage to build better infrastructure will survive. Oh well, one can dream...

sillysaurus3 9y ago
The fact that Equifax reported the breach at all represents a good faith understanding: they tell the world, and in return the world does not make them cease to exist. If you kill companies over security incidents, then magically you will no longer hear about security incidents.
- zaptheimpaler 9y ago
  They aren't doing us a favor that we have to reciprocate by reporting a breach.. its more of a responsibility. If its not required by law already, it should be.
- mirashii 9y ago
  It's not a good faith gesture, it's required by law almost everywhere they operate that they notify of a security breach of PII. http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx http://www.ncsl.org/research/telecommunications-and-informat...
  - sillysaurus3 9y ago
    And yet, as if by magic, you will no longer hear about security incidents if you kill companies.
    - Sevii 9y ago
      If there is no penalty that hurts shareholders and executives breaches aren't going to stop.
      - KGIII 9y ago
        There exists some space between no penalty and a penalty that effectively kills the company.
        watwut 9y ago
        Besides, there exists the level of mismanagement which deserves to tank the company. Investment in security costs money. Ignoring it saves money and gives company advantage against competitors who invested into it - untill breach happens. If we then effectively ok breach, we practically ensured that only bad security companies will remain living in the long term.
        jessaustin 9y ago
        Taleb called this "picking up pennies in front of a steamroller". You make a little money every day, until you get killed. Lots of management consultants specialize in recommending this stupid practice, because corporate executives can't get enough of it. It doesn't seem likely we'll see a law that effectively punishes firms for this behavior in the PII security context, because the same behavior in other contexts led not to failing firms but rather to "too big to fail" and bailouts.
      - pizza 9y ago
        Penalizing shareholders and executives to the extent that reporting breaches becomes enterprise suicide is only going to make breaches unannounced and prevent the collective from learning from individual mistakes, so therefore more common. The way to reduce breaches is to encourage open admission of security failures, so that preventative knowledge spreads quickly. It is worth some positive amount of respect to follow through in one's obligation to warn one's dependents, and moreso if one tries to warn society as a whole.
sqldba 9y ago
I know people who work with trains. They have truly awesome mechanical systems but cobbled together to IT systems they weren't qualified to program and as awful as you'd imagine and more - undocumented and unpatched. On the other hand management takes a complete 180 view to their stuff because a train derailment is extremely serious from a profit point of view, costing into the millions, and not so rare that they've never seen one. It ends up in a real weird jumble of still not acknowledging or patching anything but also being super serious about everything else like the hardware and train maintenance. I guess it's easy to point at a failed break and say that's the cause but WannaCrypt didn't cause any trains to derail.

by rdtsc 9y ago

sillysaurus3 9y ago

The fact that Equifax reported the breach at all represents a good faith understanding: they tell the world, and in return the world does not make them cease to exist. If you kill companies over security incidents, then magically you will no longer hear about security incidents.

zaptheimpaler 9y ago
They aren't doing us a favor that we have to reciprocate by reporting a breach.. its more of a responsibility. If its not required by law already, it should be.
mirashii 9y ago
It's not a good faith gesture, it's required by law almost everywhere they operate that they notify of a security breach of PII. http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx http://www.ncsl.org/research/telecommunications-and-informat...
- sillysaurus3 9y ago
  And yet, as if by magic, you will no longer hear about security incidents if you kill companies.
  - Sevii 9y ago
    If there is no penalty that hurts shareholders and executives breaches aren't going to stop.
    - KGIII 9y ago
      There exists some space between no penalty and a penalty that effectively kills the company.
      - watwut 9y ago
        Besides, there exists the level of mismanagement which deserves to tank the company. Investment in security costs money. Ignoring it saves money and gives company advantage against competitors who invested into it - untill breach happens. If we then effectively ok breach, we practically ensured that only bad security companies will remain living in the long term.
        jessaustin 9y ago
        Taleb called this "picking up pennies in front of a steamroller". You make a little money every day, until you get killed. Lots of management consultants specialize in recommending this stupid practice, because corporate executives can't get enough of it. It doesn't seem likely we'll see a law that effectively punishes firms for this behavior in the PII security context, because the same behavior in other contexts led not to failing firms but rather to "too big to fail" and bailouts.
    - pizza 9y ago
      Penalizing shareholders and executives to the extent that reporting breaches becomes enterprise suicide is only going to make breaches unannounced and prevent the collective from learning from individual mistakes, so therefore more common. The way to reduce breaches is to encourage open admission of security failures, so that preventative knowledge spreads quickly. It is worth some positive amount of respect to follow through in one's obligation to warn one's dependents, and moreso if one tries to warn society as a whole.

sqldba 9y ago

I know people who work with trains. They have truly awesome mechanical systems but cobbled together to IT systems they weren't qualified to program and as awful as you'd imagine and more - undocumented and unpatched. On the other hand management takes a complete 180 view to their stuff because a train derailment is extremely serious from a profit point of view, costing into the millions, and not so rare that they've never seen one. It ends up in a real weird jumble of still not acknowledging or patching anything but also being super serious about everything else like the hardware and train maintenance. I guess it's easy to point at a failed break and say that's the cause but WannaCrypt didn't cause any trains to derail.