3 ms·
I agree that is a real concern. The disadvantage though is that thanks to zero-day vulnerabilities it means anyone who runs a software company can get hit my l
by throwaway2016a 9y ago
I agree that is a real concern.
The disadvantage though is that thanks to zero-day vulnerabilities it means anyone who runs a software company can get hit my lightning at any time. And quite possibly through no fault of their own.
Though I suppose there could be insurance policies for that in the same way a home contractor has insurance for if they fall off a ladder.
At the same time, sending an auditor to an office for a couple days to assess their security readiness is cheaper for the tax payers than tying up the courts if/when a large company disputes the fine.
- zonethundery 9y agoThe feds already have a technology service provider supervision (i.e. 'audit') program through the FFIEC[0], which includes cybersecurity standards. The challenge for regulators is that companies not providing technology infrastructure for depository institutions are not covered. [0] Supervision of Technology Service Providers examination booklet: https://ithandbook.ffiec.gov/it-booklets/supervision-of-technology-service-providers.aspx https://ithandbook.ffiec.gov/it-booklets/supervision-of-tech...
- zardo 9y agoAnother possibility, is vendors that take responsibility for security flaws in their hardware or software. To take your contractor falling off a ladder analogy, the company that built the ladder could be held partially liable for the flaw as well.