5 ms·

There is no reason to spend one dime on infosec after the big Equifax breach and the numerous Facebook hacks/intentional spreading of data. They already lost al

There is no reason to spend one dime on infosec after the big Equifax breach and the numerous Facebook hacks/intentional spreading of data. They already lost all the most important data for every American and both companies are doing far better than ever. Nobody went to jail, everyone gets to keep making money. You should worry about lightning strikes and like solar flares disrupting your business before you worry about cyber security. Why should any enterprise risk manager waste their time on an issue that has no consequences?

loginatnine 7y ago
Is it the same for small and medium sized company though? We spend quite a lot on infosec with the premise that a breach could put us out of business since we can't afford to tarnish our reputation and loose key clients. Though I kind of agree that with Equifax and Facebook there weren't much consequences, to me they fall into the (unfortunately) too big to fail category, ie. most of Facebook members don't care and banks still need the credit score and there aren't much competition in that sector.
- moltensodium 7y ago
  My post is obviously sardonic to some extent, there are lots of situations where you need to worry about security. I think I'm just more angry about these "too big to fail" companies that are apparently immune from any oversight or consequence today. We should really just convert the FTC building into a homeless shelter and fire all employees, they have done absolutely nothing for decades so this would be great way to actually use the space effectively.
  - pas 7y ago
    Did nothing? Oh no, don't forget the great service to the nation represented by the recently approved T and Sprint merger!
- TeMPOraL 7y ago
  Depends on the market. Do your clients talk to each other? In a small market with few potential customers, reputation loss could kill you. OTOH if you sell to general population, then even a scandal involving you being featured on national TV won't hurt your company directly (related lawsuits might, though).
- howard941 7y ago
  > they fall into the (unfortunately) too big to fail category They're absolutely not too big to fail. Equifax or FB? Other than the unfortunate employees and their families, does anyone give a shit? No. No one suffers. To the contrary, thinning sick herd members helpfully invigorates the health of the surviving individuals. What these organization are are in too many pockets to be too big to jail. It's a trope but it's a fact, Jack Edits for herd reference and reduced snark
  - asark 7y ago
    The failure of Facebook might well be stimulative to employment and the economy. Imagine the wave of startups and new initiatives from other companies trying to compete in all the areas Facebook's in now. And unlike banks no significant part of the broader economy is at risk if facebook.com and instagram.com start 404ing forever tomorrow. A hiccup in the "influencer" economy, such as it is, which is negligible anyway, and they'll all have new homes one place or another (or several) inside a week and be building their followings back up. And yeah, ditto Equifax. There are two other credit agencies already. They're all same-ish as far as I can tell. Pretty sure there are only three so they can pretend there's competition, not for any actual purpose. Again, it might be an opening for a new competitor anyway, while causing minimal short-term harm.
    - NoodleIncident 7y ago
      That just sounds like breaking windows to ensure more work for glassmakers to me. You're also ignoring the value Facebook ads provide to every business who advertises on that platform.
      - howard941 7y ago
        The shattering noise is the sound of self breaking windows.
not_a_cop75 7y ago
The consequence is I won't use them and as much as possible others won't either. It's not the same as no consequence, but I get what you mean. The government plays so nicely with business that we shouldn't expect even a day's worth of business profits in related fines.
- moltensodium 7y ago
  I wish I had the option of not using Equifax (or Experian, or Transunion, or the secret telecom one), but apparently there is no way to opt out of all your most personal data being the product they sell in these private systems.
  - solotronics 7y ago
    LexisNexis? there are a bunch of opaque databases that can contain your info
- mxuribe 7y ago
  > The consequence is I won't use them... Yeah, i fully agree...But, what about orgs like equifax where you and I are not really given a choice about their role in our lives? Even before all the shenanigans around equifax, would i have willingly allowed equifax into my life? Heck no! So, while i 100% agree that we should vote with our wallets/purses, sometimes that isn't enough...and that makes me a sad panda. </sigh>
- monkeynotes 7y ago
  I am pretty sure the vast majority of people don't even know about these breaches, and even if they do it's news that passes them by quickly. Maybe a rant or two on Facebook and then onto the next thing. Almost everyone will continue to use their Capital One credit card and the company will barely see a blip in their revenue.
  - buboard 7y ago
    When the news is mainly about people dying, someone selling stolen rolodexes sounds insignificant in comparison
ashleyn 7y ago
Part of this problem is that Congress has simply stopped functioning for the past ten years or so. They're pretty much just keeping the lights on while social conservatives refuse to compromise with anyone else. When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents?
- 50ckpuppet 7y ago
  And don't forget the recycled Red Scare neo-McCarthyism they are currently using to overturn an election. Between the twits on the left and the twits on the right, we're doomed.
- ilikehurdles 7y ago
  The Consumer Financial Protection Bureau just barely makes the mark. Of course, Trump started gutting it almost immediately after joining office.
- pnutjam 7y ago
  That is hilariously backwards. "Social Conservatives" have done plenty to try an protect or aid constituents, but it's held up by the Grand Old Party in the Senate.
  - derwiki 7y ago
    Social conservatives usually mean GOP when referring to American politics
- ethbro 7y ago
  > When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents? July 1st, 2019 H.R. 3151 "Taxpayer First Act This bill revises provisions relating to the Internal Revenue Service (IRS), its customer service, enforcement procedures, cybersecurity and identity protection, management of information technology, and use of electronic systems." https://www.congress.gov/bill/116th-congress/house-bill/3151?s=5&r=2 https://www.congress.gov/bill/116th-congress/house-bill/3151... Just because actual legislation is too boring for cable news and NPR doesn't mean it's not happening. You can find all the bills that passed into law here: https://www.congress.gov/advanced-search/legislation?congresses%5B%5D=116&legislationNumbers=&restrictionType=field&restrictionFields%5B%5D=allBillTitles&restrictionFields%5B%5D=summary&summaryField=billSummary&enterTerms=&wordVariants=true&legislationTypes%5B%5D=hr&legislationTypes%5B%5D=hres&legislationTypes%5B%5D=hjres&legislationTypes%5B%5D=hconres&legislationTypes%5B%5D=hamdt&legislationTypes%5B%5D=s&legislationTypes%5B%5D=sres&legislationTypes%5B%5D=sjres&legislationTypes%5B%5D=sconres&legislationTypes%5B%5D=samdt&legislationTypes%5B%5D=suamdt&becamelaw=true&chamber=all&actionTerms=&legislativeActionWordVariants=true&dateOfActionOperator=equal&dateOfActionStartDate=&dateOfActionEndDate=&dateOfActionIsOptions=yesterday&dateOfActionToggle=multi&legislativeAction=156&sponsorState=One&member=&sponsorTypes%5B%5D=sponsor&sponsorTypes%5B%5D=sponsor&sponsorTypeBool=OR&committeeActivity%5B%5D=any&committeeActivity%5B%5D=referred+to&committeeActivity%5B%5D=hearings+by&committeeActivity%5B%5D=markup+by&committeeActivity%5B%5D=reported+by&committeeActivity%5B%5D=reported+original+measure&committeeActivity%5B%5D=discharged+from&committeeActivity%5B%5D=legislative+interest&satellite=%5B%5D&search=&submitted=Submitted&searchResultViewType=expanded https://www.congress.gov/advanced-search/legislation?congres... PS: Believe the 9/11 first responders bill would be more recent, but I figured people would take issue with that as a celebrity bill.
buboard 7y ago
I 'm considering putting up a disclaimer before signing up to my sites: "Hey there, this is the internet. Even if we 're not bad people, any data you give us may be hacked and sold , publicized etc. So don't do the dumb thing and tell us your best kept secret."
ashelmire 7y ago
I agree that we've been given clear signals that losing consumer data won't result in any negative repercussions for your business from government. Unfortunately none of us are customers of equifax - the companies we share our data with are. And those companies don't care, and include every bank. For Capital One, or other companies with which we directly do business, I think there's likely to be more direct ramifications - namely people refusing to do business with them. Letting anyone access your customers' data is a good way to lose those customers.
- kevin_thibedeau 7y ago
  Wells Fargo did much worse with actually defrauding their customers, ruining some lives, and only got a slap on the wrist.
  - imonetoo 7y ago
    I, unfortunately, am forced to do business with Wells Fargo. I recently purchased a house using a different lender and they sold my mortgage to Wells Fargo. Nothing I can do about it. I now have to have a Wells Fargo account to pay my mortgage and am just dreading the day when they start adding features to it that I didn't sign up for. About a month after learning they'd be taking over our mortgage, they got slapped on the wrist for some sort of mortgage-related fraud. It's really infuriating. At some point I may refinance just to get it moved to a different bank, but it wouldn't make financial sense to do it just yet.

loginatnine 7y ago

Is it the same for small and medium sized company though? We spend quite a lot on infosec with the premise that a breach could put us out of business since we can't afford to tarnish our reputation and loose key clients. Though I kind of agree that with Equifax and Facebook there weren't much consequences, to me they fall into the (unfortunately) too big to fail category, ie. most of Facebook members don't care and banks still need the credit score and there aren't much competition in that sector.

moltensodium 7y ago
My post is obviously sardonic to some extent, there are lots of situations where you need to worry about security. I think I'm just more angry about these "too big to fail" companies that are apparently immune from any oversight or consequence today. We should really just convert the FTC building into a homeless shelter and fire all employees, they have done absolutely nothing for decades so this would be great way to actually use the space effectively.
- pas 7y ago
  Did nothing? Oh no, don't forget the great service to the nation represented by the recently approved T and Sprint merger!
TeMPOraL 7y ago
Depends on the market. Do your clients talk to each other? In a small market with few potential customers, reputation loss could kill you. OTOH if you sell to general population, then even a scandal involving you being featured on national TV won't hurt your company directly (related lawsuits might, though).
howard941 7y ago
> they fall into the (unfortunately) too big to fail category They're absolutely not too big to fail. Equifax or FB? Other than the unfortunate employees and their families, does anyone give a shit? No. No one suffers. To the contrary, thinning sick herd members helpfully invigorates the health of the surviving individuals. What these organization are are in too many pockets to be too big to jail. It's a trope but it's a fact, Jack Edits for herd reference and reduced snark
- asark 7y ago
  The failure of Facebook might well be stimulative to employment and the economy. Imagine the wave of startups and new initiatives from other companies trying to compete in all the areas Facebook's in now. And unlike banks no significant part of the broader economy is at risk if facebook.com and instagram.com start 404ing forever tomorrow. A hiccup in the "influencer" economy, such as it is, which is negligible anyway, and they'll all have new homes one place or another (or several) inside a week and be building their followings back up. And yeah, ditto Equifax. There are two other credit agencies already. They're all same-ish as far as I can tell. Pretty sure there are only three so they can pretend there's competition, not for any actual purpose. Again, it might be an opening for a new competitor anyway, while causing minimal short-term harm.
  - NoodleIncident 7y ago
    That just sounds like breaking windows to ensure more work for glassmakers to me. You're also ignoring the value Facebook ads provide to every business who advertises on that platform.
    - howard941 7y ago
      The shattering noise is the sound of self breaking windows.

not_a_cop75 7y ago

The consequence is I won't use them and as much as possible others won't either. It's not the same as no consequence, but I get what you mean. The government plays so nicely with business that we shouldn't expect even a day's worth of business profits in related fines.

moltensodium 7y ago
I wish I had the option of not using Equifax (or Experian, or Transunion, or the secret telecom one), but apparently there is no way to opt out of all your most personal data being the product they sell in these private systems.
- solotronics 7y ago
  LexisNexis? there are a bunch of opaque databases that can contain your info
mxuribe 7y ago
> The consequence is I won't use them... Yeah, i fully agree...But, what about orgs like equifax where you and I are not really given a choice about their role in our lives? Even before all the shenanigans around equifax, would i have willingly allowed equifax into my life? Heck no! So, while i 100% agree that we should vote with our wallets/purses, sometimes that isn't enough...and that makes me a sad panda. </sigh>
monkeynotes 7y ago
I am pretty sure the vast majority of people don't even know about these breaches, and even if they do it's news that passes them by quickly. Maybe a rant or two on Facebook and then onto the next thing. Almost everyone will continue to use their Capital One credit card and the company will barely see a blip in their revenue.
- buboard 7y ago
  When the news is mainly about people dying, someone selling stolen rolodexes sounds insignificant in comparison

ashleyn 7y ago

Part of this problem is that Congress has simply stopped functioning for the past ten years or so. They're pretty much just keeping the lights on while social conservatives refuse to compromise with anyone else. When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents?

50ckpuppet 7y ago
And don't forget the recycled Red Scare neo-McCarthyism they are currently using to overturn an election. Between the twits on the left and the twits on the right, we're doomed.
ilikehurdles 7y ago
The Consumer Financial Protection Bureau just barely makes the mark. Of course, Trump started gutting it almost immediately after joining office.
pnutjam 7y ago
That is hilariously backwards. "Social Conservatives" have done plenty to try an protect or aid constituents, but it's held up by the Grand Old Party in the Senate.
- derwiki 7y ago
  Social conservatives usually mean GOP when referring to American politics
ethbro 7y ago
> When's the last time you remember high-profile federal legislation being passed with the intention of protecting or aiding constituents? July 1st, 2019 H.R. 3151 "Taxpayer First Act This bill revises provisions relating to the Internal Revenue Service (IRS), its customer service, enforcement procedures, cybersecurity and identity protection, management of information technology, and use of electronic systems." https://www.congress.gov/bill/116th-congress/house-bill/3151?s=5&r=2 https://www.congress.gov/bill/116th-congress/house-bill/3151... Just because actual legislation is too boring for cable news and NPR doesn't mean it's not happening. You can find all the bills that passed into law here: https://www.congress.gov/advanced-search/legislation?congresses%5B%5D=116&legislationNumbers=&restrictionType=field&restrictionFields%5B%5D=allBillTitles&restrictionFields%5B%5D=summary&summaryField=billSummary&enterTerms=&wordVariants=true&legislationTypes%5B%5D=hr&legislationTypes%5B%5D=hres&legislationTypes%5B%5D=hjres&legislationTypes%5B%5D=hconres&legislationTypes%5B%5D=hamdt&legislationTypes%5B%5D=s&legislationTypes%5B%5D=sres&legislationTypes%5B%5D=sjres&legislationTypes%5B%5D=sconres&legislationTypes%5B%5D=samdt&legislationTypes%5B%5D=suamdt&becamelaw=true&chamber=all&actionTerms=&legislativeActionWordVariants=true&dateOfActionOperator=equal&dateOfActionStartDate=&dateOfActionEndDate=&dateOfActionIsOptions=yesterday&dateOfActionToggle=multi&legislativeAction=156&sponsorState=One&member=&sponsorTypes%5B%5D=sponsor&sponsorTypes%5B%5D=sponsor&sponsorTypeBool=OR&committeeActivity%5B%5D=any&committeeActivity%5B%5D=referred+to&committeeActivity%5B%5D=hearings+by&committeeActivity%5B%5D=markup+by&committeeActivity%5B%5D=reported+by&committeeActivity%5B%5D=reported+original+measure&committeeActivity%5B%5D=discharged+from&committeeActivity%5B%5D=legislative+interest&satellite=%5B%5D&search=&submitted=Submitted&searchResultViewType=expanded https://www.congress.gov/advanced-search/legislation?congres... PS: Believe the 9/11 first responders bill would be more recent, but I figured people would take issue with that as a celebrity bill.

buboard 7y ago

I 'm considering putting up a disclaimer before signing up to my sites: "Hey there, this is the internet. Even if we 're not bad people, any data you give us may be hacked and sold , publicized etc. So don't do the dumb thing and tell us your best kept secret."

ashelmire 7y ago

I agree that we've been given clear signals that losing consumer data won't result in any negative repercussions for your business from government. Unfortunately none of us are customers of equifax - the companies we share our data with are. And those companies don't care, and include every bank. For Capital One, or other companies with which we directly do business, I think there's likely to be more direct ramifications - namely people refusing to do business with them. Letting anyone access your customers' data is a good way to lose those customers.

kevin_thibedeau 7y ago
Wells Fargo did much worse with actually defrauding their customers, ruining some lives, and only got a slap on the wrist.
- imonetoo 7y ago
  I, unfortunately, am forced to do business with Wells Fargo. I recently purchased a house using a different lender and they sold my mortgage to Wells Fargo. Nothing I can do about it. I now have to have a Wells Fargo account to pay my mortgage and am just dreading the day when they start adding features to it that I didn't sign up for. About a month after learning they'd be taking over our mortgage, they got slapped on the wrist for some sort of mortgage-related fraud. It's really infuriating. At some point I may refinance just to get it moved to a different bank, but it wouldn't make financial sense to do it just yet.