3 ms·

To quote a tweet from Brian Krebs, "Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they wi

To quote a tweet from Brian Krebs, "Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they will eventually sell it, leak it, lose it or get hacked and relieved of it. There really don't seem to be any exceptions, and it gets depressing." [1] Sometimes I feel like to only way to win is to not play the game. I believe that is another quote from the movie Wargames. [1] https://twitter.com/briankrebs/status/1045091640480804864 https://twitter.com/briankrebs/status/1045091640480804864

elliekelly 8y ago
Or perhaps we can change the rules of the game? It's noteworthy that he doesn't consider the possibility that a company delete/destroy the data. As it stands now, its a no-brainer for companies to save as much information as they can about a person because there's almost no down side. The risk of a data breach to the individual(s) far exceeds the risk of a breach to the corporation. The incentives are massively misaligned. I'm cautiously optimistic that GDPR (with all of it's many flaws) could mark the beginning of slow a transition from corporate data hoarding to minimalism. You heard it here first: Corporate KonMari Consultant will be the trendy Gen Z career.
- eaandkw 8y ago
  I doubt that Brian Krebs hasn't considered that. He works in information security and I would assume he is not on any corporate boards. I would however agree that even though I am not normally in favor a regulations this would be a good place to have something similar to the GDPR. There should be a balance between data being an asset vs. a liability. Right now it is only viewed as an asset so there isn't enough emphasis on security.
  - elliekelly 8y ago
    Apologies for the confusion. I simply meant that particular quote hadn't contemplated destruction. And with good reason, there's virtually no incentive for businesses to destroy data they collect. I'm certain he has given quite a lot of thought to data destruction as it relates to data security. I was trying to point out that it was conspicuously absent in his tweet.

elliekelly 8y ago

Or perhaps we can change the rules of the game? It's noteworthy that he doesn't consider the possibility that a company delete/destroy the data. As it stands now, its a no-brainer for companies to save as much information as they can about a person because there's almost no down side. The risk of a data breach to the individual(s) far exceeds the risk of a breach to the corporation. The incentives are massively misaligned. I'm cautiously optimistic that GDPR (with all of it's many flaws) could mark the beginning of slow a transition from corporate data hoarding to minimalism. You heard it here first: Corporate KonMari Consultant will be the trendy Gen Z career.

eaandkw 8y ago
I doubt that Brian Krebs hasn't considered that. He works in information security and I would assume he is not on any corporate boards. I would however agree that even though I am not normally in favor a regulations this would be a good place to have something similar to the GDPR. There should be a balance between data being an asset vs. a liability. Right now it is only viewed as an asset so there isn't enough emphasis on security.
- elliekelly 8y ago
  Apologies for the confusion. I simply meant that particular quote hadn't contemplated destruction. And with good reason, there's virtually no incentive for businesses to destroy data they collect. I'm certain he has given quite a lot of thought to data destruction as it relates to data security. I was trying to point out that it was conspicuously absent in his tweet.