5 ms·

If there is no penalty that hurts shareholders and executives breaches aren't going to stop.

• KGIII 9y ago
  There exists some space between no penalty and a penalty that effectively kills the company.
  • watwut 9y ago
    Besides, there exists the level of mismanagement which deserves to tank the company. Investment in security costs money. Ignoring it saves money and gives company advantage against competitors who invested into it - untill breach happens. If we then effectively ok breach, we practically ensured that only bad security companies will remain living in the long term.
    • jessaustin 9y ago
      Taleb called this "picking up pennies in front of a steamroller". You make a little money every day, until you get killed. Lots of management consultants specialize in recommending this stupid practice, because corporate executives can't get enough of it. It doesn't seem likely we'll see a law that effectively punishes firms for this behavior in the PII security context, because the same behavior in other contexts led not to failing firms but rather to "too big to fail" and bailouts.
• pizza 9y ago
  Penalizing shareholders and executives to the extent that reporting breaches becomes enterprise suicide is only going to make breaches unannounced and prevent the collective from learning from individual mistakes, so therefore more common. The way to reduce breaches is to encourage open admission of security failures, so that preventative knowledge spreads quickly. It is worth some positive amount of respect to follow through in one's obligation to warn one's dependents, and moreso if one tries to warn society as a whole.
  • viraptor 9y ago
    > so that preventative knowledge spreads quickly It doesn't need to spread. It's not original research. People do this every day in other places. This shouldn't be talked about as some black magic skills.
    • sillysaurus3 9y ago
      It may be tempting to believe this, but evidence would contradict you.
    • pizza 9y ago
      If security best practices weren't made irrelevant by ignorance in the first place then people wouldn't cause these preventable mishaps in the first place. It's not rigorous enough to say "I am certain some people can RTFM and understand without resorting to glorified mimicry, therefore the benefit to the group of encouraging people to share mistakes is marginal". There is just too much at stake in the outcomes of security breaches. It is far far better to be have a high variance of variance of protective + relayed benefit gained from analyzing someone else's failure, than it is to overestimate your certainty of understanding while at the same time underestimating the lessons of someone else's failures. Security is too important to put the focus on people learning in rigorous and logical ways over the protection of users. That said, due to the informational nature of security, to protect users necessarily contains as a sub-goal wholly understanding what your security is. But it's disingenuous at best to say that incident disclosure isn't actually empirically sound but instead gives security the appearance of black magic.
  • ams6110 9y ago
    That is the air crash investigation model, which has as a primary goal not assigning blame but understanding causes and what can be done differently in the future. But in many cases it boils down to "pilot error" and in those cases the pilots (if they survived) see their careers severely limited if they even fly at all anymore.