4 ms·

I'm aware of how capitalism works, but I'm not sure that equation is as straightforward as you stated. That value of risk is going up. Since the article was ab

I'm aware of how capitalism works, but I'm not sure that equation is as straightforward as you stated. That value of risk is going up. Since the article was about architecture, I was trying to point out that existing architectures have real issues.

AnIdiotOnTheNet 9y ago
And I'm trying to point out that those issues are largely irrelevant in the context of how the world actually works. You can never completely eliminate risk, only reduce it, and that reduction has costs associated with it (whether you choose to consider costs only as internal to an organization or in a broader context doesn't matter), and many times, the cost of reducing the risk outweighs any gains. It annoys me that people see "security" as a thing worth doing for its own sake. It isn't. Like almost everything else in life, it is a matter of balance. Besides, the cost of risk isn't going up. Big breaches lately off the top of my head: Sony PSN (several times), Equifax, Target, and several hospitals and schools. To my knowledge, nearly all organizations breached are still in business and often not significantly less profitable than they were before. By the internal cost metric of the organization, then, the cost was minimal. But even considering the larger ramifications on a societal scale, what has really been affected? There's been a lot of talk, and I'm sure there's been some identity theft, but the economy remains largely unaffected and so do our daily lives.
- hackerfromthefu 9y ago
  The cost of those breaches is often externalised - https://www.investopedia.com/terms/e/externality.asp https://www.investopedia.com/terms/e/externality.asp https://www.bjs.gov/index.cfm?ty=tp&tid=42 https://www.bjs.gov/index.cfm?ty=tp&tid=42 indicates that 17.6 million americans were affected by identity theft in 2014 .. sounds significant. The other thing to consider is the impact it can have on someones life, even if 99.5% of Americans aren't affected in any given year and only 17 million were, the impact of it can be huge on an individuals life. ps just used America as that was the first stats I found. First world is going to be a more prevalent target as they have more money to steal ..
  - AnIdiotOnTheNet 9y ago
    Pretty much any policy decision will have a huge impact on some individual's life, but that has nothing to do with whether or not we should enact policy does it? If I want to end the mortgage tax deduction, that's going to negatively affect every homeowner (including me, I might add), but that doesn't mean we shouldn't do it.
- hackerfromthefu 9y ago
  But I agree the cost is often not significant to companies, yet. Legislation and company costs are going to ramp up though, the pooch is getting screwed too often, and publicly .. Equifax CEO, CIO, CSO all gone, and may be done for insider trading .. http://money.cnn.com/2017/09/19/technology/equifax-legal-issues/index.html http://money.cnn.com/2017/09/19/technology/equifax-legal-iss... http://thehill.com/policy/technology/350634-ftc-launches-investigation-into-equifax-breach http://thehill.com/policy/technology/350634-ftc-launches-inv... http://www.zerohedge.com/news/2017-09-15/another-equifax-coverup-did-company-scrub-its-chief-security-officer-was-music-major http://www.zerohedge.com/news/2017-09-15/another-equifax-cov...
  - AnIdiotOnTheNet 9y ago
    The insider trading is orthogonal to the issue of security policy though. Companies shed C levels all the time for a wide variety of reasons, it isn't that big a cost on the whole.

AnIdiotOnTheNet 9y ago

And I'm trying to point out that those issues are largely irrelevant in the context of how the world actually works. You can never completely eliminate risk, only reduce it, and that reduction has costs associated with it (whether you choose to consider costs only as internal to an organization or in a broader context doesn't matter), and many times, the cost of reducing the risk outweighs any gains. It annoys me that people see "security" as a thing worth doing for its own sake. It isn't. Like almost everything else in life, it is a matter of balance. Besides, the cost of risk isn't going up. Big breaches lately off the top of my head: Sony PSN (several times), Equifax, Target, and several hospitals and schools. To my knowledge, nearly all organizations breached are still in business and often not significantly less profitable than they were before. By the internal cost metric of the organization, then, the cost was minimal. But even considering the larger ramifications on a societal scale, what has really been affected? There's been a lot of talk, and I'm sure there's been some identity theft, but the economy remains largely unaffected and so do our daily lives.

hackerfromthefu 9y ago
The cost of those breaches is often externalised - https://www.investopedia.com/terms/e/externality.asp https://www.investopedia.com/terms/e/externality.asp https://www.bjs.gov/index.cfm?ty=tp&tid=42 https://www.bjs.gov/index.cfm?ty=tp&tid=42 indicates that 17.6 million americans were affected by identity theft in 2014 .. sounds significant. The other thing to consider is the impact it can have on someones life, even if 99.5% of Americans aren't affected in any given year and only 17 million were, the impact of it can be huge on an individuals life. ps just used America as that was the first stats I found. First world is going to be a more prevalent target as they have more money to steal ..
- AnIdiotOnTheNet 9y ago
  Pretty much any policy decision will have a huge impact on some individual's life, but that has nothing to do with whether or not we should enact policy does it? If I want to end the mortgage tax deduction, that's going to negatively affect every homeowner (including me, I might add), but that doesn't mean we shouldn't do it.
hackerfromthefu 9y ago
But I agree the cost is often not significant to companies, yet. Legislation and company costs are going to ramp up though, the pooch is getting screwed too often, and publicly .. Equifax CEO, CIO, CSO all gone, and may be done for insider trading .. http://money.cnn.com/2017/09/19/technology/equifax-legal-issues/index.html http://money.cnn.com/2017/09/19/technology/equifax-legal-iss... http://thehill.com/policy/technology/350634-ftc-launches-investigation-into-equifax-breach http://thehill.com/policy/technology/350634-ftc-launches-inv... http://www.zerohedge.com/news/2017-09-15/another-equifax-coverup-did-company-scrub-its-chief-security-officer-was-music-major http://www.zerohedge.com/news/2017-09-15/another-equifax-cov...
- AnIdiotOnTheNet 9y ago
  The insider trading is orthogonal to the issue of security policy though. Companies shed C levels all the time for a wide variety of reasons, it isn't that big a cost on the whole.