6 ms·
Say you have a medical office, and you installed a cheap door lock which most burglars can easily crack, then a burglar breaks into your office, steals Ssn and
by usaphp 8y ago
Say you have a medical office, and you installed a cheap door lock which most burglars can easily crack, then a burglar breaks into your office, steals Ssn and other private info, should the doctor who runs the office go to prison for that?
- yladiz 8y agoThat's not equivalent. The equivalent would be the database or S3 bucket having a low quality password like "password".
- deleted 8y ago[deleted]
- bluntfang 8y agoare you saying leaving open filesystems and databases is the same as using a cheap lock?
- dec0dedab0de 8y agoI think it would be reasonable to have a law that says you need to have X level of security for certain information. Then it would be criminal to provide less than that level of security, especially just to save money. I just think it would have to somehow have exemptions for honest mistakes, and clever attackers.
- Nasrudith 8y agoThe problem with that is the devil is in the details and it fails to account for changes properly in technology and excludes far better alternatives. Say for instance there is a requirement that there must be DES encryption of passwords. That would be a downright terrible law on several levels - first of which is that the best way to secure passwords is not keeping them in the first place but a hash. The encryption standard is as laughable now as requiring banks lock their vaults with a simple warded lock - the kind where skeleton keys work because shaving the teeth from the key means it no longer has anything to catch on while it turns the lock.
- tareqak 8y agoYou’d have to walk back from who owns the medical office. If it’s the doctor who owns the office, then that would be the where responsibility ends. Doctors already have a responsibility to safeguard the privacy of their patient e.g. interviewing minors-turned-young-adults on their own and asking if they have permission to share the patient’s health information with their parents or guardians. If the doctor installed the lock manually and there was a reasonable expectation to install a lock of a certain strength, then yes the doctor would be responsible. If the doctor hired someone else e.g. a locksmith or the property management, then the people who were hired would be responsible so long as they were informed that they needed a particular kind of lock, they were certified to perform the installation, and there were laws on the books for the each of those kinds of responsibilities. It definitely seems onerous, burdensome, and expensive, but the costs of these kinds of security breaches have been severely discounted by those who have the power to otherwise act.
- austincheney 8y agoThe question isn't whether the door lock was great, but instead was there a door lock in the first place and if it was locked. If not do you continue to operate with an unlocked door or do you lock the damn door? You cannot stop all criminals, but you can take reasonable actions (due diligence) to ensure a reasonable effort, according to industry, and timely corrective actions once a breach is known.
- bdcravens 8y agoThe problem is there's way too many developers being given AWS keys who don't even know what a lock looks like.
- _jal 8y agoAnd one solution is enforcing consequences for incompetence. If a construction company sends a bunch of untrained yahoos out with explosives, well, maybe the yahoos should have known better, but the company absolutely should have known better and I have no problem holding them liable.
- mixmastamyk 8y agoDoctor no, owner yes.