4 ms·

Data breaches are definitely not ideal. If there were legislations where penalties, enforcement, and audits added a large cost of the underlying goods I purchas

by drchiu 9y ago

Data breaches are definitely not ideal. If there were legislations where penalties, enforcement, and audits added a large cost of the underlying goods I purchase, however, I’m not sure I would like that either. There’s an inherent risk in online businesses, no matter what policies are in place. I would say that whatever progress is made shouldn’t impede new businesses to come in and challenge incumbents or make the overall cost a barrier for less affluent users.

lilott8 9y ago
I would envision this system to be something such as: We have a set of standards that define what negligence looks like for data breaches, security, etc. If a company is found to not adhere to these standards they would be found negligent and assessed some financial penalty. If a company is found to be adhering to the standards, and is hit by a 0-day, the financial penalty would be negligible or 0.
- libdjml 9y ago
  This is a huge unsolved problem in journalism: reporting whether a company was wildly negligible and deserved to be punished, or did the right things and fell victim to “no org can be bulletproof” Some standards like PCI attempt to do this, but to date they have no real teeth. GDPR may be the change we need. I have deep concern that C-levels will learn that breaches don’t matter, just have a CISO you can behead and replace when it does.
  - lilott8 9y ago
    There are certain things that are, collectively, patently negligent: storing passwords in plain text, not salting passwords, not using, at a minimum, software firewalls, etc. Those are fairly boolean. It's also fair to assume that any company that is hit with a 0-day is not negligent; even the best prepared companies are susceptible to them. So there is some decent guidelines to rely upon to demonstrate negligence or not on the extremes. Of course, in the middle it does, admittedly a bit gray. But the teeth that come into play would look exactly like GDPR. Yes, I agree completely, that C-levels will see that the CISO is a replaceable widget that is nothing more than a scapegoat.
- kolinko 9y ago
  Unless you tie that with company size, such regulation would kill startups.
rando444 9y ago
You only have to worry about penalties if you're deliberately doing something wrong. Auditing can be done internally, and if making sure you're not putting your customers at risk is too big of a task for a business, maybe the business needs to be re-thought.
- macintux 9y ago
  > You only have to worry about penalties if you're deliberately doing something wrong. I don't know how you define "deliberately doing something wrong" without either making it too broad or worthless. It's rare that any organization "deliberately" exposes their customer information. It's also effectively impossible for any organization to guarantee that the data is unbreachable.
  - rando444 9y ago
    If you read up on the GDPR, the focus is on people 'deliberately doing something wrong'.. which could be not following proper security guidelines, not keeping proper records, not notifying the users in a timely manner, and all sorts of things that are very cut and dry. It's perfectly possible to have a data breach and not get fined, and as long as you didn't do anything too careless that would allow a breach to happen you're probably in the clear. Everyone knows there's no perfect system.. but in regards to what we're talking about it's much better to have personal data be a liability rather than an asset, because it puts incentive on companies to only use what they need and make efforts to protect it appropriately.
    - joesb 9y ago
      I don't think not following proper standard is deliberatelt doing something wrong. What if I'm just unaware of the standard or incompetent? Not all programmer who save password in plaintext starts by thinking "I'm going to intentionally doing this wrong so that it breaks all security guidelines".
      - isostatic 9y ago
shakna 9y ago
In other businesses where a risk is inherent, we require insurance to help deal with the fallout.

by drchiu 9y ago

lilott8 9y ago

I would envision this system to be something such as: We have a set of standards that define what negligence looks like for data breaches, security, etc. If a company is found to not adhere to these standards they would be found negligent and assessed some financial penalty. If a company is found to be adhering to the standards, and is hit by a 0-day, the financial penalty would be negligible or 0.

libdjml 9y ago
This is a huge unsolved problem in journalism: reporting whether a company was wildly negligible and deserved to be punished, or did the right things and fell victim to “no org can be bulletproof” Some standards like PCI attempt to do this, but to date they have no real teeth. GDPR may be the change we need. I have deep concern that C-levels will learn that breaches don’t matter, just have a CISO you can behead and replace when it does.
- lilott8 9y ago
  There are certain things that are, collectively, patently negligent: storing passwords in plain text, not salting passwords, not using, at a minimum, software firewalls, etc. Those are fairly boolean. It's also fair to assume that any company that is hit with a 0-day is not negligent; even the best prepared companies are susceptible to them. So there is some decent guidelines to rely upon to demonstrate negligence or not on the extremes. Of course, in the middle it does, admittedly a bit gray. But the teeth that come into play would look exactly like GDPR. Yes, I agree completely, that C-levels will see that the CISO is a replaceable widget that is nothing more than a scapegoat.
kolinko 9y ago
Unless you tie that with company size, such regulation would kill startups.

rando444 9y ago

You only have to worry about penalties if you're deliberately doing something wrong. Auditing can be done internally, and if making sure you're not putting your customers at risk is too big of a task for a business, maybe the business needs to be re-thought.

macintux 9y ago
> You only have to worry about penalties if you're deliberately doing something wrong. I don't know how you define "deliberately doing something wrong" without either making it too broad or worthless. It's rare that any organization "deliberately" exposes their customer information. It's also effectively impossible for any organization to guarantee that the data is unbreachable.
- rando444 9y ago
  If you read up on the GDPR, the focus is on people 'deliberately doing something wrong'.. which could be not following proper security guidelines, not keeping proper records, not notifying the users in a timely manner, and all sorts of things that are very cut and dry. It's perfectly possible to have a data breach and not get fined, and as long as you didn't do anything too careless that would allow a breach to happen you're probably in the clear. Everyone knows there's no perfect system.. but in regards to what we're talking about it's much better to have personal data be a liability rather than an asset, because it puts incentive on companies to only use what they need and make efforts to protect it appropriately.
  - joesb 9y ago
    I don't think not following proper standard is deliberatelt doing something wrong. What if I'm just unaware of the standard or incompetent? Not all programmer who save password in plaintext starts by thinking "I'm going to intentionally doing this wrong so that it breaks all security guidelines".
    - isostatic 9y ago

shakna 9y ago

In other businesses where a risk is inherent, we require insurance to help deal with the fallout.