3 ms·
> that method of attacking the assets under protection almost certainly exceeds their value This was most likely the reasoning Sony had used (prior to 2012) wh
by marshray 8y ago
> that method of attacking the assets under protection almost certainly exceeds their value
This was most likely the reasoning Sony had used (prior to 2012) when deciding how to safeguard the account info of users who had registered for marketing promotions.
It turned out that user credentials are unlike, say, office furniture, in that the cost of a data breach can vastly exceed the "value" of the protected "asset".
- Alex3917 8y agoThat's the best practice in the security world though. There's no such thing as an unhackable system, only systems where A) the cost of attacking them is more than the value of the assets under protection B) where the time it takes to attack the system is long enough for the attack to be detected. C.f. Bruce Schneier's book: https://www.schneier.com/books/beyond_fear/ https://www.schneier.com/books/beyond_fear/
- marshray 8y agoThat book was from 2003. This is Schneier in 2016: https://www.schneier.com/essays/archives/2016/03/data_is_a_toxic_asse.html https://www.schneier.com/essays/archives/2016/03/data_is_a_t... Data Is a Toxic Asset, So Why Not Throw It Out? "All this makes data a toxic asset, and it continues to be toxic as long as it sits in a company's computers and networks. The data is vulnerable, and the company is vulnerable. It's vulnerable to hackers and governments. It's vulnerable to employee error. And when there's a toxic data spill, millions of people can be affected. The 2015 Anthem Health data breach affected 80 million people. The 2013 Target Corp. breach affected 110 million. If data is toxic, why do organizations save it? ..."