6 ms·

I don't understand it. Here is hn, where everyone knows that cybersecurity is 100% offence 0% defence. It is basically our job to secure systems and we all agre

I don't understand it. Here is hn, where everyone knows that cybersecurity is 100% offence 0% defence. It is basically our job to secure systems and we all agree it is pretty much impossible, unless you airgap every computer in building and glue every USB port. Then, knowing that, we blame equifax for data breach. Equifax is fat target and it was matter of time data would be stolen.

fastball 7y ago
Equifax's security practices were laughably bad.
Angostura 7y ago
> we all agree it is pretty much impossible, unless.... ... well, not waiting months to patch a vulnerability in a well-known piece of software us probably a start.
kalleboo 7y ago
I agree with you, but if you can't secure the data, you shouldn't collect it in the first place. Not collecting data to begin with is a big part of the GDPR.
deaps 7y ago
The fact remains that when not following 'best practices' - you leave yourself (and those that you horde data on) at risk. I think that the upsetting part is that most don't volunteer their data to these guys. They simply get spoon-fed our data, profit greatly from our data, and then grossly mishandle that data, failing to follow even simple security best practices throughout.
raesene9 7y ago
Security is not binary. It's possible to do a good job on preventative measures, and implement detective and reactive controls to help if/when a breach occurs. It's just expensive, so companies who haven't been breached yet often don't prioritize that kind of work.
mlrtime 7y ago
HN definitely has a pitchfork mentality similar to other groups. It also leans politically left. It's not as bad as reddit yet but it is slowly getting that way (waiting for downvotes).
- pas 7y ago
  What does political leaning has to do with IT sec?
  - deleted 7y ago
    [deleted]
  - probablyexists 7y ago
    It is a pretty common tactic on general topic websites lately. It is easier to dismiss comments without actual reasoning if you assume they are from people that don't align with your political views.
- castis 7y ago
  Maybe we should make a hard right and protect our servers with assault rifles instead.
deleted 7y ago
[deleted]

fastball 7y ago

Equifax's security practices were laughably bad.

Angostura 7y ago

> we all agree it is pretty much impossible, unless.... ... well, not waiting months to patch a vulnerability in a well-known piece of software us probably a start.

kalleboo 7y ago

I agree with you, but if you can't secure the data, you shouldn't collect it in the first place. Not collecting data to begin with is a big part of the GDPR.

deaps 7y ago

The fact remains that when not following 'best practices' - you leave yourself (and those that you horde data on) at risk. I think that the upsetting part is that most don't volunteer their data to these guys. They simply get spoon-fed our data, profit greatly from our data, and then grossly mishandle that data, failing to follow even simple security best practices throughout.

raesene9 7y ago

Security is not binary. It's possible to do a good job on preventative measures, and implement detective and reactive controls to help if/when a breach occurs. It's just expensive, so companies who haven't been breached yet often don't prioritize that kind of work.

mlrtime 7y ago

HN definitely has a pitchfork mentality similar to other groups. It also leans politically left. It's not as bad as reddit yet but it is slowly getting that way (waiting for downvotes).

pas 7y ago
What does political leaning has to do with IT sec?
- deleted 7y ago
  [deleted]
- probablyexists 7y ago
  It is a pretty common tactic on general topic websites lately. It is easier to dismiss comments without actual reasoning if you assume they are from people that don't align with your political views.
castis 7y ago
Maybe we should make a hard right and protect our servers with assault rifles instead.

deleted 7y ago

[deleted]