5 ms·

> unfortunately this is just becoming the norm and companies aren't held accountable for losing data How would a company be held accountable for losing data? F

by umvi 7y ago

> unfortunately this is just becoming the norm and companies aren't held accountable for losing data How would a company be held accountable for losing data? Fining them? Paying out to users?

ziddoap 7y ago
Fining a company for gross negligence of assets they are entrusted with seems like a fair path to explore for starters.
- umvi 7y ago
  It seems like you would have to prove it is gross negligence though. It's not their fault if they lost a database to a 0day or if they were otherwise doing everything reasonably correctly.
  - ziddoap 7y ago
    Well... Yes. That is how it usually works. You prove gross negligence, they pay a fine. They prove that they were doing everything reasonably in their power, they don't pay a fine.
  - AdieuToLogic 7y ago
    >It seems like you would have to prove it is gross negligence though. Storing PAN's in clear text is a violation of many, if not all, payment networks, be it done by a Merchant or any intermediary. The citation I will show below is MasterCard specific, but should not be considered restricted to that network. > It's not their fault if they lost a database to a 0day or if they were otherwise doing everything reasonably correctly. Actually, it very well can be. And, in this case, it almost certainly is the Merchant's liability (fault) due to not adhering to security standards. For reference regarding same, see the MasterCard "Security Rules and Procedures" document's "Chapter 10 Account Data Protection Standards and Programs"[0]. 0 - https://www.mastercard.us/content/dam/mccom/en-us/documents/rules/SPME-Manual-February-2019.pdf#_OPENTOPIC_TOC_PROCESSING_d94e8528 https://www.mastercard.us/content/dam/mccom/en-us/documents/...
EpicEng 7y ago
>Fining them? Paying out to users? ...Yes? With the caveat of an investigation and a ruling of negligence... by someone.
Thriptic 7y ago
Pass a law that says every lost user account is an X dollar fine based on data "richness" that can't be discharged in bankruptcy. For simplicity, let's say $10 in this case. 160 million lost accounts is now a 1.6 billion dollar fine. That is enough to cripple a lot of companies. It would make people think long and hard about what data they wanted to keep and how they wanted to secure it. Alternatively, create a situation where companies are responsible in perpetuity for damages related to identity theft if a victim's credentials are lost. If company X loses my SSN and then someone opens up a fake account in my name, they are automatically responsible for any costs I incur and I don't have to prove attribution. The purpose should be to heavily, heavily disincentivize any storage of basic data or PII unless absolutely necessary.
- umvi 7y ago
  Yes, that would also make it really easy for individuals/corporations/state actors/etc. to destroy companies: secretly employ security researchers that compromise your target's database and bam, you've just crippled/ruined them. China tired of US putting pressure on Huawei? Bam, start targeting American companies and totally financially ruin them using their own privacy laws/fines against them! Disgruntled suicidal employee has a grudge? Take down the whole company on your way out with that backdoor time bomb you planted and let the $1.6B fine do the rest!
  - Jweb_Guru 7y ago
    You know that there are other industries that have heavy regulatory fines like this, right? The existence of a software culture where a single rogue employee can easily destroy the privacy of hundreds of millions of people is itself a huge part of the security problem. If there were actual consequences for this kind of thing there would be a lot of changes to software development practices. I'm not saying that culture alone will make code perfectly secure, but I do think caring about the code being secure (in the sense that the company will face deep financial and legal trouble if it isn't) is a necessary prerequisite. Arguably, it's the only thing that works. You may argue that you can't just buy absence of security bugs with money and a different culture, but there are plenty of formal verification tools out there, and they are not all toys. True, verified code is expensive compared to writing "normal" software, which is developed using the same best practices" that lead to a data breach being announced seemingly every other day. But it is quite cost-competitive with "high assurance" software (i.e. software developed when people face real consequences for the existence of bugs) and the techniques have been used to secure a number of nontrivial real systems by now. I have absolutely no doubt (as someone who's in the field) that we would see a huge boost to the state of the art in that field if there were actual money in it, especially considering how much of the current difficulty with using formal verification comes down to the lack of user-friendly tooling. But, to reiterate, my larger argument isn't really about formal verification; I'm mostly bringing it up to refute the argument that the existence of bugs is something totally outside of any company's control. Ultimately companies are currently choosing not to pay to make their code secure, and it's not hard to see why given the current legal climate of "there are no consequences whatsoever." Ideally, the first step towards fixing this would be for the software development community at large to acknowledge that it is, actually, a choice, but frankly I don't see things happening that way. If a move towards not just safer, but genuinely bug-free (or at least, bug-free outside of hitherto undiscovered exotic side channels) software is going to happen at all, it'll be because a large government drags its country's unwilling programmers and CEOs in that direction.
buckminster 7y ago
Flay the directors and steep them in brine. I can dream.

by umvi 7y ago

> unfortunately this is just becoming the norm and companies aren't held accountable for losing data How would a company be held accountable for losing data? Fining them? Paying out to users?

ziddoap 7y ago

Fining a company for gross negligence of assets they are entrusted with seems like a fair path to explore for starters.

umvi 7y ago
It seems like you would have to prove it is gross negligence though. It's not their fault if they lost a database to a 0day or if they were otherwise doing everything reasonably correctly.
- ziddoap 7y ago
  Well... Yes. That is how it usually works. You prove gross negligence, they pay a fine. They prove that they were doing everything reasonably in their power, they don't pay a fine.
- AdieuToLogic 7y ago
  >It seems like you would have to prove it is gross negligence though. Storing PAN's in clear text is a violation of many, if not all, payment networks, be it done by a Merchant or any intermediary. The citation I will show below is MasterCard specific, but should not be considered restricted to that network. > It's not their fault if they lost a database to a 0day or if they were otherwise doing everything reasonably correctly. Actually, it very well can be. And, in this case, it almost certainly is the Merchant's liability (fault) due to not adhering to security standards. For reference regarding same, see the MasterCard "Security Rules and Procedures" document's "Chapter 10 Account Data Protection Standards and Programs"[0]. 0 - https://www.mastercard.us/content/dam/mccom/en-us/documents/rules/SPME-Manual-February-2019.pdf#_OPENTOPIC_TOC_PROCESSING_d94e8528 https://www.mastercard.us/content/dam/mccom/en-us/documents/...

EpicEng 7y ago

>Fining them? Paying out to users? ...Yes? With the caveat of an investigation and a ruling of negligence... by someone.

Thriptic 7y ago

Pass a law that says every lost user account is an X dollar fine based on data "richness" that can't be discharged in bankruptcy. For simplicity, let's say $10 in this case. 160 million lost accounts is now a 1.6 billion dollar fine. That is enough to cripple a lot of companies. It would make people think long and hard about what data they wanted to keep and how they wanted to secure it. Alternatively, create a situation where companies are responsible in perpetuity for damages related to identity theft if a victim's credentials are lost. If company X loses my SSN and then someone opens up a fake account in my name, they are automatically responsible for any costs I incur and I don't have to prove attribution. The purpose should be to heavily, heavily disincentivize any storage of basic data or PII unless absolutely necessary.

umvi 7y ago
Yes, that would also make it really easy for individuals/corporations/state actors/etc. to destroy companies: secretly employ security researchers that compromise your target's database and bam, you've just crippled/ruined them. China tired of US putting pressure on Huawei? Bam, start targeting American companies and totally financially ruin them using their own privacy laws/fines against them! Disgruntled suicidal employee has a grudge? Take down the whole company on your way out with that backdoor time bomb you planted and let the $1.6B fine do the rest!
- Jweb_Guru 7y ago
  You know that there are other industries that have heavy regulatory fines like this, right? The existence of a software culture where a single rogue employee can easily destroy the privacy of hundreds of millions of people is itself a huge part of the security problem. If there were actual consequences for this kind of thing there would be a lot of changes to software development practices. I'm not saying that culture alone will make code perfectly secure, but I do think caring about the code being secure (in the sense that the company will face deep financial and legal trouble if it isn't) is a necessary prerequisite. Arguably, it's the only thing that works. You may argue that you can't just buy absence of security bugs with money and a different culture, but there are plenty of formal verification tools out there, and they are not all toys. True, verified code is expensive compared to writing "normal" software, which is developed using the same best practices" that lead to a data breach being announced seemingly every other day. But it is quite cost-competitive with "high assurance" software (i.e. software developed when people face real consequences for the existence of bugs) and the techniques have been used to secure a number of nontrivial real systems by now. I have absolutely no doubt (as someone who's in the field) that we would see a huge boost to the state of the art in that field if there were actual money in it, especially considering how much of the current difficulty with using formal verification comes down to the lack of user-friendly tooling. But, to reiterate, my larger argument isn't really about formal verification; I'm mostly bringing it up to refute the argument that the existence of bugs is something totally outside of any company's control. Ultimately companies are currently choosing not to pay to make their code secure, and it's not hard to see why given the current legal climate of "there are no consequences whatsoever." Ideally, the first step towards fixing this would be for the software development community at large to acknowledge that it is, actually, a choice, but frankly I don't see things happening that way. If a move towards not just safer, but genuinely bug-free (or at least, bug-free outside of hitherto undiscovered exotic side channels) software is going to happen at all, it'll be because a large government drags its country's unwilling programmers and CEOs in that direction.

buckminster 7y ago

Flay the directors and steep them in brine. I can dream.