3 ms·

the only way security will ever be taken seriously us if there are fines for leaking data. $1000 per user per incident. Nothing will ever happen otherwise. Ther

• gruez 9y ago
  Great, now you've incentivized coverup of breaches.
  • joering2 9y ago
    .. which actually is the way HIPAA operates :( Source: worked too many years in "Healthcare IT" and left some companies after seeing how they mistreat PII.
  • smt88 9y ago
    Whistleblowers should be (maybe are?) given a cut of any fines that their disclosure results in.
    • chias 9y ago
      If we're talking $1000 per impacted user as suggested by GP, then I'm wondering just how small a fraction of the 37 billion dollar fine it would take for me to swallow my morals and "accidentally" cause or approve changes which cause a vulnerability like this, so I can then blow the whistle and collect my check. As a security engineer, I doubt my net worth will ever reach even 0.05% of that.
      • smt88 9y ago
        Whistleblowers should be compensated for uncovering intentional negligence and violation of laws, not accidents. There should be a pattern of bad behavior that the whistleblower couldn't create herself.