5 ms·

> a large committee composed mostly of lawyers is not probably the right group to even determine what needs to be done, in this particular case Whelp... this i

> a large committee composed mostly of lawyers is not probably the right group to even determine what needs to be done, in this particular case Whelp... this is who is deciding what gets done in pretty much all cases.

rossdavidh 9y ago
True, in regards to laws, but in some cases their expertise helps. For example, tort reform might be an issue where a bunch of lawyers do have relevant expertise that the rest of us lack, to see possible unintended consequences, and also what is possible given the rest of the system. But, in the case of IT security, their experience and expertise is, at best, not helpful.
- tareqak 9y ago
  However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? Isn't a generic concept like that well-understood for lawyers and other people familiar with law?
  - thephyber 9y ago
    > However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? "keeping customer information secure" is not a binary. Most companies that are breached don't know about it until their dat hits the black market. Yahoo! revised their data brach estimates upwards half a dozen times from 100million+ to ~3billion+. The plaintiffs would have to affirmatively prove that a breach happened to the defendant when most defendants don't even know that it happened. It is even harder to contractually enforce when the victim claims it was a nation-state-actor/APT since no company could hold out against a determined APT indefinitely. I'm hopeful that cybersecurity insurance policies will move the needle towards accountability and increased prevention (insurance policies will require good-faith efforts at security policies+procedures+tools+employee actions or they won't pay out).
    - tareqak 9y ago
      OK, what about: If a company storing private customer information gets breached (sufficient evidence is found of said breach), then the company must make itself fully available for a third-party investigation to confirm the existence of said breach. If the third-party investigator finds evidence of a breach, then said breach happened. If not, then there was no breach. If one third-party investigator is an insufficiently reliable number, then what about the best two out of three?
thephyber 9y ago
Not exactly. If it were possible for all of the affected to individually sue Equifax, many of them already would have. But the US civil-legal system requires "standing", which in turn requires proof of "damages". The sad fact is that loss of sensitive information is not quantifiable as "damages" for this purpose, even though that same information is worth well north of $millions when the FEC looks at the same kind of information transaction in election campaigns. "The markets" that fiscal conservatives love to talk about don't work when our civil system doesn't recognize that there is value and a market there. If the data breach had resulted in masses of data being traded on the black market, the Equifax breach may have ended in prosecutions and massive lawsuits. Because it didn't, it likely won't end in much. Hell, not even the banks, retailers, and ID security services that did business with Equifax bothered to make a big deal about cancelling their contracts+relationships. The sad fact is that there's a tiny pool of companies with this data and cutting off one company gives the other players (who aren't much better at securing their networks) massive leverage.

rossdavidh 9y ago

True, in regards to laws, but in some cases their expertise helps. For example, tort reform might be an issue where a bunch of lawyers do have relevant expertise that the rest of us lack, to see possible unintended consequences, and also what is possible given the rest of the system. But, in the case of IT security, their experience and expertise is, at best, not helpful.

tareqak 9y ago
However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? Isn't a generic concept like that well-understood for lawyers and other people familiar with law?
- thephyber 9y ago
  > However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? "keeping customer information secure" is not a binary. Most companies that are breached don't know about it until their dat hits the black market. Yahoo! revised their data brach estimates upwards half a dozen times from 100million+ to ~3billion+. The plaintiffs would have to affirmatively prove that a breach happened to the defendant when most defendants don't even know that it happened. It is even harder to contractually enforce when the victim claims it was a nation-state-actor/APT since no company could hold out against a determined APT indefinitely. I'm hopeful that cybersecurity insurance policies will move the needle towards accountability and increased prevention (insurance policies will require good-faith efforts at security policies+procedures+tools+employee actions or they won't pay out).
  - tareqak 9y ago
    OK, what about: If a company storing private customer information gets breached (sufficient evidence is found of said breach), then the company must make itself fully available for a third-party investigation to confirm the existence of said breach. If the third-party investigator finds evidence of a breach, then said breach happened. If not, then there was no breach. If one third-party investigator is an insufficiently reliable number, then what about the best two out of three?

thephyber 9y ago

Not exactly. If it were possible for all of the affected to individually sue Equifax, many of them already would have. But the US civil-legal system requires "standing", which in turn requires proof of "damages". The sad fact is that loss of sensitive information is not quantifiable as "damages" for this purpose, even though that same information is worth well north of $millions when the FEC looks at the same kind of information transaction in election campaigns. "The markets" that fiscal conservatives love to talk about don't work when our civil system doesn't recognize that there is value and a market there. If the data breach had resulted in masses of data being traded on the black market, the Equifax breach may have ended in prosecutions and massive lawsuits. Because it didn't, it likely won't end in much. Hell, not even the banks, retailers, and ID security services that did business with Equifax bothered to make a big deal about cancelling their contracts+relationships. The sad fact is that there's a tiny pool of companies with this data and cutting off one company gives the other players (who aren't much better at securing their networks) massive leverage.