5 ms·

Some of us mentioned that this would happen once GDPR came out. Not disclosing breaches is now a punishable offense, and this becomes a weapon in the hands of

• kardos 7y ago
  Viewed from the 'sometimes things have to get worse before they get better' lens, it might drive better security/backups/etc in the medium term.
  • macintux 7y ago
    If anything, this escalation would seem to _discourage_ backups. Backups are another way to leak data.
    • mannykannot 7y ago
      Any adminstrator who thinks that is a rational policy should be fired.
      • ls612 7y ago
        Agreed, but a lawyer who thought it is a rational policy may be right. And if the IT admin is arguing against the counsel he is unlikely to win that argument.
        • mannykannot 7y ago
          In what way would a lawyer who thought it is a rational policy be right?
          • jessaustin 7y ago
            He might be general counsel, in which case he would outrank any IT admin. In many organizations, that is another way to be "right".
            • mannykannot 7y ago
              When ransomware is the issue, that's the wrong way to be right.
            • loopz 7y ago
              As admin you must then document the communications and escalate until you're heard. If even CEO won't listen you're either wrong or need to report to authority outside org through established means.
    • nokcha 7y ago
      Ideally, backups (or at least the decryption key for the backup) would be stored in offline, air-gapped storage.
• JadeNB 7y ago
  > Not disclosing breaches is now a punishable offense, and this becomes a weapon in the hands of malicious hackers. Maybe that wasn't meant as such, but it comes across, at least to me, as an argument that making non-disclosure punishable was a bad idea. If that was the argument, then I'd point out that the same thing can be said of criminalising any offence at all.
  • buboard 7y ago
    there is no argument. there's also no law that demands you to report all crimes. and this law does give an incentive to cover up, as long as the ransom is < fines .
    • mannykannot 7y ago
      Any entity that settles without making the required disclosure of the breach (see my other post) puts itself at risk of being blackmailed over that non-disclosure.
      • buboard 7y ago
        of course, but that is a risk, while the fines are definite
        • mannykannot 7y ago
          Definite and limited. Once you take the cover-up route, the potential cost escalates unpredictably, and there is nothing definite about the ultimate cost.
          • buboard 7y ago
            actually, the law acts as a guideline about which point you should cut your losses.
            • mannykannot 7y ago
• mannykannot 7y ago
  From article 4: (12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; So it seems that a ransomware attack is considered a breach - as it should be - and neither exfiltration nor disclosure is necessary for that to be the case. Any sort of access is a weapon in the hands of a malicious hacker. Penalties for allowing it to happen are weapons in the hands of those trying to do something about it.
  • buboard 7y ago
    security is notoriously asymmetric and a continuous arms race, so it's rarely a case of "allowing it to happen". There is a case to be made for making it unprofitable for hackers to run such operations. The law here does the opposite by making it more lucrative. i think the best thing to do is to minimize sensitive data completely, no logs no nothing. But then you move the burden of security to the end user (e.g. they 'll have to re-enter their credit card every time), which is probably higher risk.
    • mannykannot 7y ago
      If everyone adopted your solution, the issue that you originally posted about would no longer be an issue, so the best way to get everyone to your solution would be increase the penalties until nothing else is viable! The reality is that you are creating a false dichotomy / straw man here. While reducing the amount of personal information that is gathered and stored should be the first response, that which remains can be handled appropriately with encryption and defense-in-depth.