12 ms·

Having the government outline minimum penalties for data breaches would go a long way toward fixing the problem. It’s much easier to justify fixing a known issu

by koolba 8y ago

Having the government outline minimum penalties for data breaches would go a long way toward fixing the problem. It’s much easier to justify fixing a known issue or dedicating time to updating dependencies if you know there’s a defined cost (per customer!) of failing to do so.

SteveNuts 8y ago
This is how I feel also. Businesses will always weigh the potential costs of a breach vs cost for proper security methods. Until you can quantify that with hard numbers for a breach, they will not take it seriously.
freedomben 8y ago
I don't disagree, but it's really really hard to determine what proper liability should be. It's easy with things like "Company X left their S3 bucket publicly accessible then put PII in it." It's much less easy when "Company Y got hacked because of a 0-day in their OS kernel, or in their web server that is an open-source project, or even a 0-day in a codebase that they own but have generally very good practices on (stuff happens, even very good devs write bugs sometimes)." Does the Linux Foundation or a group of random devs on github that gave their code away for free get handed a massive and possibly bankrupting fine for that? And if so, why would anybody release code for free? If not, and you say that "GPL/MIT/etc. warrants no serviceability so it's on the adopter," then why would anybody use open source and open themselves up to the liability when they have zero control over the project and its associated quality control and process? For this reason I don't think governments can do a good job at making fair regulation that doesn't have severe unintended consequences. Something that might help tho, is providing easier civil recourse for those affected. For example, if Equifax gets hacked and leaks my identity and somebody buys a car in my name, it should be very easy for me to sue them to make it right. That's something that is clearly broken with our current system.
- sopooneo 8y ago
  I say companies should pay a painful fine for all data breaches no matter what. They'll have to buy insurance against it, and the insurers will eventually learn to price the risk properly. And it will also be in the insurers' interest to learn how to audit their client companies.
  - TeMPOraL 8y ago
    Yup. Take GDPR. It doesn't try to price user data. If you screw up real bad, it just says, "up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher".
- felix_nagaand 8y ago
  Failing to disclose a breach should be treated like covering up a crime. Companies are dissolved, fines levied, people go to jail, damages are paid. Failing to address security vulnerabilities quickly, or publicize their existence and suspend operations until they're fixed is negligent and is most similar to reckless endangerment. Similarly, hiring inexperienced, unqualified, or otherwise knowingly incapable people to perform a job is negligence. Failing to know and perform what precautions one needs to take is likewise negligent. People go to jail, fines are levied, damages are paid. A previously unknown exploit used to gain access to a company is like a car accident and should be treated as such. Company pays damages and moves on.
pg_bot 8y ago
I think it is important to make the distinction that it is the impact of the breach that is important and not the breach itself. If the information gained from a breach, say credit card numbers, is immediately rendered useless by the action of the breached company should they be penalized? I also find it unlikely that penalties would be accurately priced, which is a whole separate conversation of perverse incentives. I think most data breaches boil down to poor culture and management. Software maintenance gets cheaper as you do it more frequently since the complexity of deferred maintenance scales exponentially. It's a lot easier to justify doing things when the costs to do them are nearly nothing. This is ideally where we should aim as an industry.
- ridgeguy 8y ago
  I think it's not simple to predict the impact of a breach. I would rather the breach itself be penalized. I prefer incentives that prevent spilling the milk to post-spill arguments about how damaging the spill may have been.
  - AnthonyMouse 8y ago
    > I prefer incentives that prevent spilling the milk to post-spill arguments about how damaging the spill may have been. Then what you want is subsidies to audit popular software/hardware for vulnerabilities. This is a classic high transaction cost tragedy of the commons. The manufacturer has no incentive to make secure devices because customers still buy the insecure ones. Imposing liability is difficult because the issues are highly technical (difficult for judge/jury to understand) and the damages are highly speculative and hard to calculate. Imposing specific security standards is equally problematic because of the same bad interaction between technical complexity and politicians. But the solutions are known -- it basically just requires money for security hardening. So have the government provide the money. Without specific byzantine standards it allows the job to be done properly, and providing the money removes the incentive to cut corners.
    - TeMPOraL 8y ago
      > But the solutions are known -- it basically just requires money for security hardening. So have the government provide the money. Without specific byzantine standards it allows the job to be done properly, and providing the money removes the incentive to cut corners. If you don't force the audit, why a company would want to take a risk with testing their product? I feel that at best, it'll end up like "quality seals" on food items. Yes, I can draw a quality seal in Photoshop too. But even if companies would be somehow willing (how, without forcing them?), then you need to ensure the audits are reliable, and prevent companies from creating a fake rubber-stamping auditing entity, and going to market either way. What's the preferred way to accomplish that? Companies are in a race to the bottom, and they'll do their best to weasel out of "unnecessary" costs.
AnthonyMouse 8y ago
> Having the government outline minimum penalties for data breaches would go a long way toward fixing the problem. Then companies start covering up data breaches because disclosing them would cost millions in fines, resulting in people not even knowing when they've been compromised. You also have the problem where politicians/media have no idea what they're talking about, e.g. calling the Google+ issue a "data breach" when it was actually a vulnerability discovered internally with no evidence of anyone having ever used it. If that's the standard then every time there is a vulnerability in a major operating system or TLS library, no one will be safe from the litigious trolls.
- tomjakubowski 8y ago
  > Then companies start covering up data breaches because disclosing them would cost millions in fines, resulting in people not even knowing when they've been compromised. Couldn't you make this same argument about any law that punishes bad behavior? As an extreme example, if we make murder illegal, that incentivizes covering up the act, at the expense of closure for victims' families. It seems flawed to me.
  - AnthonyMouse 8y ago
    It's a lot harder to cover up a murder than a data breach. People notice when a someone turns up dead or mysteriously disappears. If some criminals break into your servers, who has any way to know other than you and the criminals? There is also the issue of intent. Murder is illegal when you intend to do it. Nobody intends to have a data breach. In that case sunlight is more important than punishment because it's in everyone's interest to prevent it happening again, which requires understanding how it happened, which requires cooperation. Putting otherwise-aligned people on opposite sides creates unnecessary conflict at odds with the common goal.
    - pka 8y ago
      I'm not sure you could cover up a data breach that easily. Those data dumps are going to be sold on the black market eventually, and I speculate that in many cases government agencies will be able to identify unannounced breaches. Slap a 10x (or even 100x) fine on companies whose data breaches are discovered independently and covering stuff up won't look like such a good idea anymore.
matt4077 8y ago
The problem with fines as an enforcement mechanism is that incidents are rare and big. Fines work when they are assured, fast, and high. But because the incident that triggers fines is not the actual behaviour, but only its later consequences, it's too easy to put off security "for some other time". It's like a single superhero randomly killing shoplifters every few months: the penalty is far disproportionate, yet the policy is still not going to stop anyone.
EinsDueTresFour 8y ago
Hasn't GDPR already established some fines for breaches [1]? I know it's only for Europe and those who interact with it, etc., but I remember my lecturer arguing that it was just a matter of time until the rest of the world follows suit. [1] https://www.gdpr.associates/data-breach-penalties/ https://www.gdpr.associates/data-breach-penalties/
netcan 8y ago
Imo, the most effective part of gdpr is the self disclosure stuff. Transparency has already improved and pressure to avoid disclosable leaks has gone up. Idk that fines would help that much. I would just double down on the disclosure part. Improved policing of nondisclosure (with penalties).

by koolba 8y ago

SteveNuts 8y ago

This is how I feel also. Businesses will always weigh the potential costs of a breach vs cost for proper security methods. Until you can quantify that with hard numbers for a breach, they will not take it seriously.

freedomben 8y ago

I don't disagree, but it's really really hard to determine what proper liability should be. It's easy with things like "Company X left their S3 bucket publicly accessible then put PII in it." It's much less easy when "Company Y got hacked because of a 0-day in their OS kernel, or in their web server that is an open-source project, or even a 0-day in a codebase that they own but have generally very good practices on (stuff happens, even very good devs write bugs sometimes)." Does the Linux Foundation or a group of random devs on github that gave their code away for free get handed a massive and possibly bankrupting fine for that? And if so, why would anybody release code for free? If not, and you say that "GPL/MIT/etc. warrants no serviceability so it's on the adopter," then why would anybody use open source and open themselves up to the liability when they have zero control over the project and its associated quality control and process? For this reason I don't think governments can do a good job at making fair regulation that doesn't have severe unintended consequences. Something that might help tho, is providing easier civil recourse for those affected. For example, if Equifax gets hacked and leaks my identity and somebody buys a car in my name, it should be very easy for me to sue them to make it right. That's something that is clearly broken with our current system.

sopooneo 8y ago
I say companies should pay a painful fine for all data breaches no matter what. They'll have to buy insurance against it, and the insurers will eventually learn to price the risk properly. And it will also be in the insurers' interest to learn how to audit their client companies.
- TeMPOraL 8y ago
  Yup. Take GDPR. It doesn't try to price user data. If you screw up real bad, it just says, "up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher".
felix_nagaand 8y ago
Failing to disclose a breach should be treated like covering up a crime. Companies are dissolved, fines levied, people go to jail, damages are paid. Failing to address security vulnerabilities quickly, or publicize their existence and suspend operations until they're fixed is negligent and is most similar to reckless endangerment. Similarly, hiring inexperienced, unqualified, or otherwise knowingly incapable people to perform a job is negligence. Failing to know and perform what precautions one needs to take is likewise negligent. People go to jail, fines are levied, damages are paid. A previously unknown exploit used to gain access to a company is like a car accident and should be treated as such. Company pays damages and moves on.

pg_bot 8y ago

I think it is important to make the distinction that it is the impact of the breach that is important and not the breach itself. If the information gained from a breach, say credit card numbers, is immediately rendered useless by the action of the breached company should they be penalized? I also find it unlikely that penalties would be accurately priced, which is a whole separate conversation of perverse incentives. I think most data breaches boil down to poor culture and management. Software maintenance gets cheaper as you do it more frequently since the complexity of deferred maintenance scales exponentially. It's a lot easier to justify doing things when the costs to do them are nearly nothing. This is ideally where we should aim as an industry.

ridgeguy 8y ago
I think it's not simple to predict the impact of a breach. I would rather the breach itself be penalized. I prefer incentives that prevent spilling the milk to post-spill arguments about how damaging the spill may have been.
- AnthonyMouse 8y ago
  > I prefer incentives that prevent spilling the milk to post-spill arguments about how damaging the spill may have been. Then what you want is subsidies to audit popular software/hardware for vulnerabilities. This is a classic high transaction cost tragedy of the commons. The manufacturer has no incentive to make secure devices because customers still buy the insecure ones. Imposing liability is difficult because the issues are highly technical (difficult for judge/jury to understand) and the damages are highly speculative and hard to calculate. Imposing specific security standards is equally problematic because of the same bad interaction between technical complexity and politicians. But the solutions are known -- it basically just requires money for security hardening. So have the government provide the money. Without specific byzantine standards it allows the job to be done properly, and providing the money removes the incentive to cut corners.
  - TeMPOraL 8y ago
    > But the solutions are known -- it basically just requires money for security hardening. So have the government provide the money. Without specific byzantine standards it allows the job to be done properly, and providing the money removes the incentive to cut corners. If you don't force the audit, why a company would want to take a risk with testing their product? I feel that at best, it'll end up like "quality seals" on food items. Yes, I can draw a quality seal in Photoshop too. But even if companies would be somehow willing (how, without forcing them?), then you need to ensure the audits are reliable, and prevent companies from creating a fake rubber-stamping auditing entity, and going to market either way. What's the preferred way to accomplish that? Companies are in a race to the bottom, and they'll do their best to weasel out of "unnecessary" costs.

AnthonyMouse 8y ago

> Having the government outline minimum penalties for data breaches would go a long way toward fixing the problem. Then companies start covering up data breaches because disclosing them would cost millions in fines, resulting in people not even knowing when they've been compromised. You also have the problem where politicians/media have no idea what they're talking about, e.g. calling the Google+ issue a "data breach" when it was actually a vulnerability discovered internally with no evidence of anyone having ever used it. If that's the standard then every time there is a vulnerability in a major operating system or TLS library, no one will be safe from the litigious trolls.

tomjakubowski 8y ago
> Then companies start covering up data breaches because disclosing them would cost millions in fines, resulting in people not even knowing when they've been compromised. Couldn't you make this same argument about any law that punishes bad behavior? As an extreme example, if we make murder illegal, that incentivizes covering up the act, at the expense of closure for victims' families. It seems flawed to me.
- AnthonyMouse 8y ago
  It's a lot harder to cover up a murder than a data breach. People notice when a someone turns up dead or mysteriously disappears. If some criminals break into your servers, who has any way to know other than you and the criminals? There is also the issue of intent. Murder is illegal when you intend to do it. Nobody intends to have a data breach. In that case sunlight is more important than punishment because it's in everyone's interest to prevent it happening again, which requires understanding how it happened, which requires cooperation. Putting otherwise-aligned people on opposite sides creates unnecessary conflict at odds with the common goal.
  - pka 8y ago
    I'm not sure you could cover up a data breach that easily. Those data dumps are going to be sold on the black market eventually, and I speculate that in many cases government agencies will be able to identify unannounced breaches. Slap a 10x (or even 100x) fine on companies whose data breaches are discovered independently and covering stuff up won't look like such a good idea anymore.

matt4077 8y ago

The problem with fines as an enforcement mechanism is that incidents are rare and big. Fines work when they are assured, fast, and high. But because the incident that triggers fines is not the actual behaviour, but only its later consequences, it's too easy to put off security "for some other time". It's like a single superhero randomly killing shoplifters every few months: the penalty is far disproportionate, yet the policy is still not going to stop anyone.

EinsDueTresFour 8y ago

Hasn't GDPR already established some fines for breaches [1]? I know it's only for Europe and those who interact with it, etc., but I remember my lecturer arguing that it was just a matter of time until the rest of the world follows suit. [1] https://www.gdpr.associates/data-breach-penalties/ https://www.gdpr.associates/data-breach-penalties/

netcan 8y ago

Imo, the most effective part of gdpr is the self disclosure stuff. Transparency has already improved and pressure to avoid disclosable leaks has gone up. Idk that fines would help that much. I would just double down on the disclosure part. Improved policing of nondisclosure (with penalties).