4 ms·

How is that possible with all the regulation?

mschuster91 7y ago
Because regulation is only as good as its enforcement.
sergioisidoro 7y ago
Regulation means nothing without proper auditing and enforcement. Question is how are countries (US in this case) not enforcing the most basic regulation...
superzamp 7y ago
I work with financial software and you'd be surprised how much of all this "regulation" is based on self assessments. Auditors are looking for liability shifts, not real security.
- greedo 7y ago
  And auditors don't really have access to passwords etc. They can run an assessment tool to see that there's an account named "admin," but typically don't get access to /etc/shadow or passwords within applications. Now a pentester? If they don't spot this during an assessment, they suck. But pentesting isn't always performed on a rigorous schedule.
- davismwfl 7y ago
  I was dumbfounded by this when I was consulting prior and worked with some banks on mortgage compliance. Almost everything about banking is self assessments and reporting. It is similar to the idea of Boeing doing self testing for the FAA and reporting all is fine. Regulation doesn't bring safety or security, it brings reporting that rarely gets analyzed and even if it is there is no way it will show anything but the most blatant of fraud etc. It is akin to closing the barn doors after the horses have all left, at least the banks can say hey 10 horses left, but nothing was done to prevent it and they won't get in trouble cause they reported on it. At least that was kinda my takeaway from those jobs. I could just have a skewed version based on the stuff I worked on.
afarrell 7y ago
Regulation doesn't matter directly. What matters is organisational culture. Regulation is one tool to change the culture of organisations in an industry, but it only works if it is * Communicated clearly so that there is a path to compliance[1]. * Enforced with penalties so that people within non-infinite-budget organisations can sell[2] the change as a means to cut costs[3]. ------ [1] If you only do the 1st, then it is like forcing children to swim by throwing them off a boat. Some people think that "sink or swim" forces someone to swim; it doesn't. It just presents two possibilities: swim or die. [2] https://www.kalzumeus.com/2014/04/09/what-heartbleed-can-teach-the-oss-community-about-marketing/ https://www.kalzumeus.com/2014/04/09/what-heartbleed-can-tea... [3] https://www.kalzumeus.com/2011/10/28/dont-call-yourself-a-programmer/ https://www.kalzumeus.com/2011/10/28/dont-call-yourself-a-pr...

Because regulation is only as good as its enforcement.

Regulation means nothing without proper auditing and enforcement. Question is how are countries (US in this case) not enforcing the most basic regulation...

superzamp 7y ago

I work with financial software and you'd be surprised how much of all this "regulation" is based on self assessments. Auditors are looking for liability shifts, not real security.

greedo 7y ago
And auditors don't really have access to passwords etc. They can run an assessment tool to see that there's an account named "admin," but typically don't get access to /etc/shadow or passwords within applications. Now a pentester? If they don't spot this during an assessment, they suck. But pentesting isn't always performed on a rigorous schedule.
davismwfl 7y ago
I was dumbfounded by this when I was consulting prior and worked with some banks on mortgage compliance. Almost everything about banking is self assessments and reporting. It is similar to the idea of Boeing doing self testing for the FAA and reporting all is fine. Regulation doesn't bring safety or security, it brings reporting that rarely gets analyzed and even if it is there is no way it will show anything but the most blatant of fraud etc. It is akin to closing the barn doors after the horses have all left, at least the banks can say hey 10 horses left, but nothing was done to prevent it and they won't get in trouble cause they reported on it. At least that was kinda my takeaway from those jobs. I could just have a skewed version based on the stuff I worked on.

afarrell 7y ago

Regulation doesn't matter directly. What matters is organisational culture. Regulation is one tool to change the culture of organisations in an industry, but it only works if it is * Communicated clearly so that there is a path to compliance[1]. * Enforced with penalties so that people within non-infinite-budget organisations can sell[2] the change as a means to cut costs[3]. ------ [1] If you only do the 1st, then it is like forcing children to swim by throwing them off a boat. Some people think that "sink or swim" forces someone to swim; it doesn't. It just presents two possibilities: swim or die. [2] https://www.kalzumeus.com/2014/04/09/what-heartbleed-can-teach-the-oss-community-about-marketing/ https://www.kalzumeus.com/2014/04/09/what-heartbleed-can-tea... [3] https://www.kalzumeus.com/2011/10/28/dont-call-yourself-a-programmer/ https://www.kalzumeus.com/2011/10/28/dont-call-yourself-a-pr...