4 ms·

I used to do contract pentesting for a big fortune 500 company, and they were able to cut all kinds of security corners because they knew people would perceive

by dx87 8y ago

I used to do contract pentesting for a big fortune 500 company, and they were able to cut all kinds of security corners because they knew people would perceive them as the victim. The person running our contract at the company said that the people making budget decisions know that at worst there'll be a small stock dip for 1-2 days in the event of a compromise, so they said it's not worth the money to actually have good security because the general public will just see the headlines and consider the company the equivalent of a robbery victim.

TheSpiceIsLife 8y ago
When people say there are no consequences for the company yadda yadda yadda what they neglect to also mention is that, typically, there are no consequences for those affected either. If the one billion odd people affected by major data breaches since 2005¹ all experienced some significant difficulty as a result, we could probably expect a louder outcry and subsequent changes in behaviour by those we entrust(?) our personal identifying information to. I've been online since well before 2005, and the worst I've experience is one debit card being cancelled due to a failed fraudulent transaction attempt ~10 years ago, and ~2 months ago a successful fraudulent transaction of AU$13.36 which I noticed immediately (thanks mobile banking app notifications), which resulted in the me calling and cancelling the card and the charge being reversed. Of course, we're all paying more in fees due to insurance against such events, but that appears to be an inconvenience that most people simply don't rate. 1. https://news.ycombinator.com/item?id=18297966 https://news.ycombinator.com/item?id=18297966