4 ms·
The solution here is not technical - we already know the technical solution. The solution is to introduce a cost to the risk. Right now the "risk" has no cost
by volgo 9y ago
The solution here is not technical - we already know the technical solution. The solution is to introduce a cost to the risk.
Right now the "risk" has no cost - if you expose people's data there's not that much consequence besides bad PR. We should assign some dollar value to each person's identify leaked. That way, businesses can properly asses risk and reward when they start these types of projects
Overtime, I think businesses would rather avoid the liability of storing people's info in the first place
- nautilus12 9y agoExactly, there are best practices to avoid these scenarios. The engineers are just being pushed to produce so quickly that they end up doing things like this. The problem has been for faaar to long that doing tech right takes much longer than the business side of the company is willing to wait for.
- altharaz 9y agoThis is exactly what will happen in Europe next year. With the General Data Protection Regulation, any leak of private data caused by a major cybersecurity gap in a company will lead to severe financial sanctions such as a fine based on 4% of the company turnover. This law will indeed give the risk a “cost” :).
- closeparen 9y agoAs I understand it, Europe does not generally suffer from the disease of banks and courts accepting knowledge of basic demographic data as proof of identity. GDPR is not really comparable to the mess of the US social security number situation. The risk we need is to introduce is to make banks (not customers) responsible when banks allow themselves to be tricked w.r.t. personal identity. This would motivate them to come up with identity verification schemes reflecting ~anything at all that the security community has figured out in 50+ years.
- enraged_camel 9y agoThe other cost we can introduce into the equation is holding corporate leaders personally liable for these types of gross negligence. Once CEOs know that they can go to prison if their customers' data is stolen, I assure you that they will suddenly become very interested in making sure their underlings follow best practices.