3 ms·
This would be awesome if it applied to security breaches as well. Not sure how you would fine OPM, but there are a ton of consumer companies that have leaked da
by TACIXAT 7y ago
This would be awesome if it applied to security breaches as well. Not sure how you would fine OPM, but there are a ton of consumer companies that have leaked data like a sieve.
- zavi 7y agoYou cannot fine companies for being technically incompetent.
- spaceheretostay 7y agoSurely you can - that could amount to criminal negligence which is definitely a crime.
- gtirloni 7y agoYes, you can and should. But how do you define negligence in IT? We don't have the same codified norms as civil engineering so it'd be very subjective.
- TACIXAT 7y agoI feel the best test was "did you get breached? what data was taken?", if the answers are yes and PII, you were collecting data that you didn't have the capability to protect and should face a fine. There is a lot a company can do to protect data. If they demonstrate that they were following all those best practices re: encryption, storage, least privilege, etc. then that should absolutely factor in. At least to hold people accountable who store stuff in plain text and leave it on publicly accessible storage.
- rooam-dev 7y agoThat is not an excuse. Imagine not fining people for reckless driving.
- kazen44 7y agowhat? ofcourse you can. just look at any industry that puts people in danger when people make technically incompetent mistakes. even the most basic electrician is held to a higher standard then facebook in this regard...