3 ms·

Penalizing shareholders and executives to the extent that reporting breaches becomes enterprise suicide is only going to make breaches unannounced and prevent t

by pizza 9y ago

Penalizing shareholders and executives to the extent that reporting breaches becomes enterprise suicide is only going to make breaches unannounced and prevent the collective from learning from individual mistakes, so therefore more common. The way to reduce breaches is to encourage open admission of security failures, so that preventative knowledge spreads quickly. It is worth some positive amount of respect to follow through in one's obligation to warn one's dependents, and moreso if one tries to warn society as a whole.

viraptor 9y ago
> so that preventative knowledge spreads quickly It doesn't need to spread. It's not original research. People do this every day in other places. This shouldn't be talked about as some black magic skills.
- sillysaurus3 9y ago
  It may be tempting to believe this, but evidence would contradict you.
- pizza 9y ago
  If security best practices weren't made irrelevant by ignorance in the first place then people wouldn't cause these preventable mishaps in the first place. It's not rigorous enough to say "I am certain some people can RTFM and understand without resorting to glorified mimicry, therefore the benefit to the group of encouraging people to share mistakes is marginal". There is just too much at stake in the outcomes of security breaches. It is far far better to be have a high variance of variance of protective + relayed benefit gained from analyzing someone else's failure, than it is to overestimate your certainty of understanding while at the same time underestimating the lessons of someone else's failures. Security is too important to put the focus on people learning in rigorous and logical ways over the protection of users. That said, due to the informational nature of security, to protect users necessarily contains as a sub-goal wholly understanding what your security is. But it's disingenuous at best to say that incident disclosure isn't actually empirically sound but instead gives security the appearance of black magic.
ams6110 9y ago
That is the air crash investigation model, which has as a primary goal not assigning blame but understanding causes and what can be done differently in the future. But in many cases it boils down to "pilot error" and in those cases the pilots (if they survived) see their careers severely limited if they even fly at all anymore.

by pizza 9y ago

viraptor 9y ago

> so that preventative knowledge spreads quickly It doesn't need to spread. It's not original research. People do this every day in other places. This shouldn't be talked about as some black magic skills.

sillysaurus3 9y ago
It may be tempting to believe this, but evidence would contradict you.
pizza 9y ago
If security best practices weren't made irrelevant by ignorance in the first place then people wouldn't cause these preventable mishaps in the first place. It's not rigorous enough to say "I am certain some people can RTFM and understand without resorting to glorified mimicry, therefore the benefit to the group of encouraging people to share mistakes is marginal". There is just too much at stake in the outcomes of security breaches. It is far far better to be have a high variance of variance of protective + relayed benefit gained from analyzing someone else's failure, than it is to overestimate your certainty of understanding while at the same time underestimating the lessons of someone else's failures. Security is too important to put the focus on people learning in rigorous and logical ways over the protection of users. That said, due to the informational nature of security, to protect users necessarily contains as a sub-goal wholly understanding what your security is. But it's disingenuous at best to say that incident disclosure isn't actually empirically sound but instead gives security the appearance of black magic.

ams6110 9y ago

That is the air crash investigation model, which has as a primary goal not assigning blame but understanding causes and what can be done differently in the future. But in many cases it boils down to "pilot error" and in those cases the pilots (if they survived) see their careers severely limited if they even fly at all anymore.