3 ms·

I wonder if this will further reduce the incentive for companies to disclose that they've been hacked. If, upon disclosure, they know they'll get a red flag, th

I wonder if this will further reduce the incentive for companies to disclose that they've been hacked. If, upon disclosure, they know they'll get a red flag, then why should they? Without more information (e.g. the extent of the hack, how long ago it was, how it was handled, what the company has done to make things better) either integrated into the metric, or provided as separate metrics, this might be counter-productive. But who decides on those metrics and sets the hurdle to display a flag or not? I would suggest a government or UN agency, perhaps akin to a CERT org; in fact first.org (as a confederation of CERTs) might be a starting point. Also, this sort of thing might produce false negatives where different sites/URLs use the same (compromised) backend data.

Sylos 9y ago
In my country, it's illegal to not disclose a hack that you know of. So, bigger fines would be one way to incentivize them.
- vectorEQ 9y ago
  same here, but then again, if you don't disclose it and cover it up properly, who's to say you've been hacked? it's a bit of a chicken and egg problem. unless some external party can prove you are hacked, which is not always the case, it's hard to apply this law to anyone. To properly apply it, countries would have to scrape and invesitgate all sites in their locality, which is a problem, as automated processes for this can lead to false positives, and that could be very damaging for a company, as the fines are very high and would be devastating for a company who is wrongly accused by some automated process. (which is why they are careful with implementing such a measure i think, or i hope)
  - zaarn 9y ago
    Easy, if there is incentive for companies to cover it up then hackers can blackmail them for a decent amount of money in form of Bitcoin. I personally would not shy away from doing that if I had some unresolved grudge against the company in question.

Sylos 9y ago

In my country, it's illegal to not disclose a hack that you know of. So, bigger fines would be one way to incentivize them.

vectorEQ 9y ago
same here, but then again, if you don't disclose it and cover it up properly, who's to say you've been hacked? it's a bit of a chicken and egg problem. unless some external party can prove you are hacked, which is not always the case, it's hard to apply this law to anyone. To properly apply it, countries would have to scrape and invesitgate all sites in their locality, which is a problem, as automated processes for this can lead to false positives, and that could be very damaging for a company, as the fines are very high and would be devastating for a company who is wrongly accused by some automated process. (which is why they are careful with implementing such a measure i think, or i hope)
- zaarn 9y ago
  Easy, if there is incentive for companies to cover it up then hackers can blackmail them for a decent amount of money in form of Bitcoin. I personally would not shy away from doing that if I had some unresolved grudge against the company in question.