4 ms·

> Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Two competitors in a spa

> Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Two competitors in a space. One has 3 developers and 1 security guy, the other has 4 developers. In 99/100 outcomes, all else being equal, the 4 developer guy will add more features and outpace the other team and win the market. Security is an overhead and a drag on company resources.. until it's not. But how many startups fail due to lack of a security team? I cannot think of any from my RL network. I am sure some exist... but otherwise, this is the same as most "safety" measures... unimportant until it is really important.

bproven 9y ago
Mainly b/c there are no real downsides/penalties to leaking data (or PII) - you say "sorry" and just move on. Sometimes with an increased stock price - see Equifax :(
- reaperducer 9y ago
  Depends on the industry. In some heavily-regulated industries, there are huge fines at stake for leaking information. Look at healthcare. If information leaks, it has to be reported to the feds within 24 hours of initial discovery. Not C-level finding out, but whatever low-level employee finds it. Even if it's one person. If it's more than around 10 people, there's a federal requirement to report it to the local media.
  - bussierem 9y ago
    >In some heavily-regulated industries I think the fact that this doesn't apply to "the people storing our credit and SSN information" is just about the apex of stupidity.
  - txcwpalpha 9y ago
    I used to work specifically in the healthcare space doing cleanup work for companies that had been recently breached. I think "huge fines" is quite an overstatement. The largest HIPAA fine in history for a data breach was for the Anthem hack, which was a leak of ~80 million records and Anthem was fined $115 million. That's no small number, but at the end of the day it's still only less than 5% of their yearly net income. And Anthem is a huge outlier: the second largest HIPAA fine in history was only ~$6 million. It's not exactly a huge deterrent for companies that want to ignore security. In terms of the public exposure, you'd probably be surprised at how many healthcare insurers/providers have data breaches but you never hear about them because these companies know how/when to report it so that it ends up nothing more than a footnote on the back page of the local paper.
derefr 9y ago
> But how many startups fail due to lack of a security team? Crypto exchange startups, for a big, glaring example. They’re an exception in a lot of ways, though.
- nevir 9y ago
  They're also a category where security is inherently a user-visible feature of their products (and as such, it _should_ be easier to justify security engineers)
- golergka 9y ago
  I thought that there was a non zero probability that they are "hacking" themselves, simply taking customers money and inventing excuses for it.
kbenson 9y ago
> In 99/100 outcomes In other news, in 99/100 occurrences of the phrase "99 times out of 100" the person stating it is pulling numbers out of their ass to sound authoritative. If you think the vast majority of the time the extra developer helps that company succeed and outperform the other company, then perhaps you should start with "I think the vast majority of the time..." instead of making up magical numbers. Sure, we all know the numbers are bullshit, but that's not excuse where there are perfectly normal ways to express what you mean that don't masquerade as fact. > Security is an overhead and a drag on company resources.. until it's not. And sometimes that "until it's not" could be from the very beginning, if it's used for market differentiation. As soon a you talk about competition and businesses it becomes about a whole lot more than technical merit and features. Things like current market position, advertising, strategic partnerships, etc start having an impact, and sometimes it's a large one.
- brianwawok 9y ago
  > In other news, in 99/100 occurrences of the phrase "99 times out of 100" the person stating it is pulling numbers out of their ass to sound authoritative. I can use whatever writing style I want to. If you don't like it, read another post.
  - kbenson 9y ago
    Sure you can. And I'll free to call out when you are making factual assertions that aren't facts. In the same vein, you're free to ignore my comment. I'll concede my original comment might have come across as a bit more harsh than intended, but I think the point stands. If you're trying to prove a point or provide information in a discussion, don't use loose and hyperbolic terminology without expecting to be called out on it.
    - throwawaynrl 9y ago
      Good god, it wasn’t meant to be LITERALLY 99/100, and anyone who reads it that way has some serious textual interpretation problems.
    - 9y ago

bproven 9y ago

Mainly b/c there are no real downsides/penalties to leaking data (or PII) - you say "sorry" and just move on. Sometimes with an increased stock price - see Equifax :(

reaperducer 9y ago
Depends on the industry. In some heavily-regulated industries, there are huge fines at stake for leaking information. Look at healthcare. If information leaks, it has to be reported to the feds within 24 hours of initial discovery. Not C-level finding out, but whatever low-level employee finds it. Even if it's one person. If it's more than around 10 people, there's a federal requirement to report it to the local media.
- bussierem 9y ago
  >In some heavily-regulated industries I think the fact that this doesn't apply to "the people storing our credit and SSN information" is just about the apex of stupidity.
- txcwpalpha 9y ago
  I used to work specifically in the healthcare space doing cleanup work for companies that had been recently breached. I think "huge fines" is quite an overstatement. The largest HIPAA fine in history for a data breach was for the Anthem hack, which was a leak of ~80 million records and Anthem was fined $115 million. That's no small number, but at the end of the day it's still only less than 5% of their yearly net income. And Anthem is a huge outlier: the second largest HIPAA fine in history was only ~$6 million. It's not exactly a huge deterrent for companies that want to ignore security. In terms of the public exposure, you'd probably be surprised at how many healthcare insurers/providers have data breaches but you never hear about them because these companies know how/when to report it so that it ends up nothing more than a footnote on the back page of the local paper.

derefr 9y ago

> But how many startups fail due to lack of a security team? Crypto exchange startups, for a big, glaring example. They’re an exception in a lot of ways, though.

nevir 9y ago
They're also a category where security is inherently a user-visible feature of their products (and as such, it _should_ be easier to justify security engineers)
golergka 9y ago
I thought that there was a non zero probability that they are "hacking" themselves, simply taking customers money and inventing excuses for it.

kbenson 9y ago

> In 99/100 outcomes In other news, in 99/100 occurrences of the phrase "99 times out of 100" the person stating it is pulling numbers out of their ass to sound authoritative. If you think the vast majority of the time the extra developer helps that company succeed and outperform the other company, then perhaps you should start with "I think the vast majority of the time..." instead of making up magical numbers. Sure, we all know the numbers are bullshit, but that's not excuse where there are perfectly normal ways to express what you mean that don't masquerade as fact. > Security is an overhead and a drag on company resources.. until it's not. And sometimes that "until it's not" could be from the very beginning, if it's used for market differentiation. As soon a you talk about competition and businesses it becomes about a whole lot more than technical merit and features. Things like current market position, advertising, strategic partnerships, etc start having an impact, and sometimes it's a large one.

brianwawok 9y ago
> In other news, in 99/100 occurrences of the phrase "99 times out of 100" the person stating it is pulling numbers out of their ass to sound authoritative. I can use whatever writing style I want to. If you don't like it, read another post.
- kbenson 9y ago
  Sure you can. And I'll free to call out when you are making factual assertions that aren't facts. In the same vein, you're free to ignore my comment. I'll concede my original comment might have come across as a bit more harsh than intended, but I think the point stands. If you're trying to prove a point or provide information in a discussion, don't use loose and hyperbolic terminology without expecting to be called out on it.
  - throwawaynrl 9y ago
    Good god, it wasn’t meant to be LITERALLY 99/100, and anyone who reads it that way has some serious textual interpretation problems.
  - 9y ago