3 ms·

The dynamic is exemplified by The Formula. " Narrator: A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The

The dynamic is exemplified by The Formula. " Narrator: A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." Is there an aspect of this movie quote that does not apply to vulnerabilities?

marcosdumay 7y ago
Yes. There are no settlements to care about, so the total cost is always 0.
- mandelbrotwurst 7y ago
  That's not true, e.g, Equifax.
  - loeg 7y ago
    Equifax settled for less than $425 million[1], once, but generally makes ~$2 billion in profit annually on ~$3.5 billion in revenue[2]. It might very well be true that $425 million is cheaper than it would have been for them to have better security practices, i.e., a metaphorical recall. [1]: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... [2]: https://www.macrotrends.net/stocks/charts/EFX/equifax/gross-profit https://www.macrotrends.net/stocks/charts/EFX/equifax/gross-...
    - quanticle 7y ago
      To pile on to that, there haven't been any ongoing consequences for Equifax as a result of the breach. They're still one of the "big 3" credit reporting bureaus. They're still used by lots of banks, mortgage originators, apartments owners, car dealerships, etc. to assess people's credit ratings. This applies to other companies that have suffered large-scale data breaches. What were the consequences to Target, T.J. Maxx, or Home Depot for their data breaches? Did they suffer a meaningful loss in market share as a result of their lax security? Heck, I would be surprised today if many customers even remembered that these retailers had a data breach, much less factor that into their decision to shop at those places. It's to the point where, if I see a publicly traded firm suffer a major data breach, I almost want to buy stock in it, knowing that the price will dip temporarily due to whatever one-time fees the firm pays out, but will rapidly return to pre-breach levels as consumers forget that the company leaked their personal information like a sieve.
    - mandelbrotwurst 7y ago
      Sure, I was just saying that such settlements do exist and that their costs are not zero.
- saagarjha 7y ago
  There’s also bad publicity.
  - quanticle 7y ago
    Bad publicity doesn't matter if it's not remembered. How many people remember Target's data breach? How many people remember Home Depot's data breach? What about T.J. Maxx? What about Sony's Playstation Network? What about Michael's [1]? Or P.F. Chang's [2]? Or IHG Hotels [3]? At this point, it's easier to name companies that have not been breached. And yet, despite every year bringing news of yet another breach of credit card data or other personal information, there are approximately zero long-term consequences. Consumers quickly forget, and are only reminded if they get a notice of a class-action settlement 5 or 6 years later for a paltry amount per customer. [1]: https://www.nytimes.com/2014/04/19/business/michaels-stores-confirms-breach-involving-three-million-customers.html?_r=0 https://www.nytimes.com/2014/04/19/business/michaels-stores-... [2]: https://www.usatoday.com/story/money/business/2014/06/13/pf-changs-data-breach/10413015/ https://www.usatoday.com/story/money/business/2014/06/13/pf-... [3]: https://www.reuters.com/article/us-hotels-cyber-idUSKCN10P0ZM https://www.reuters.com/article/us-hotels-cyber-idUSKCN10P0Z...
sullyj3 7y ago
This equation is missing a term for lost sales due to damage to public image.

marcosdumay 7y ago

Yes. There are no settlements to care about, so the total cost is always 0.

mandelbrotwurst 7y ago
That's not true, e.g, Equifax.
- loeg 7y ago
  Equifax settled for less than $425 million[1], once, but generally makes ~$2 billion in profit annually on ~$3.5 billion in revenue[2]. It might very well be true that $425 million is cheaper than it would have been for them to have better security practices, i.e., a metaphorical recall. [1]: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... [2]: https://www.macrotrends.net/stocks/charts/EFX/equifax/gross-profit https://www.macrotrends.net/stocks/charts/EFX/equifax/gross-...
  - quanticle 7y ago
    To pile on to that, there haven't been any ongoing consequences for Equifax as a result of the breach. They're still one of the "big 3" credit reporting bureaus. They're still used by lots of banks, mortgage originators, apartments owners, car dealerships, etc. to assess people's credit ratings. This applies to other companies that have suffered large-scale data breaches. What were the consequences to Target, T.J. Maxx, or Home Depot for their data breaches? Did they suffer a meaningful loss in market share as a result of their lax security? Heck, I would be surprised today if many customers even remembered that these retailers had a data breach, much less factor that into their decision to shop at those places. It's to the point where, if I see a publicly traded firm suffer a major data breach, I almost want to buy stock in it, knowing that the price will dip temporarily due to whatever one-time fees the firm pays out, but will rapidly return to pre-breach levels as consumers forget that the company leaked their personal information like a sieve.
  - mandelbrotwurst 7y ago
    Sure, I was just saying that such settlements do exist and that their costs are not zero.
saagarjha 7y ago
There’s also bad publicity.
- quanticle 7y ago
  Bad publicity doesn't matter if it's not remembered. How many people remember Target's data breach? How many people remember Home Depot's data breach? What about T.J. Maxx? What about Sony's Playstation Network? What about Michael's [1]? Or P.F. Chang's [2]? Or IHG Hotels [3]? At this point, it's easier to name companies that have not been breached. And yet, despite every year bringing news of yet another breach of credit card data or other personal information, there are approximately zero long-term consequences. Consumers quickly forget, and are only reminded if they get a notice of a class-action settlement 5 or 6 years later for a paltry amount per customer. [1]: https://www.nytimes.com/2014/04/19/business/michaels-stores-confirms-breach-involving-three-million-customers.html?_r=0 https://www.nytimes.com/2014/04/19/business/michaels-stores-... [2]: https://www.usatoday.com/story/money/business/2014/06/13/pf-changs-data-breach/10413015/ https://www.usatoday.com/story/money/business/2014/06/13/pf-... [3]: https://www.reuters.com/article/us-hotels-cyber-idUSKCN10P0ZM https://www.reuters.com/article/us-hotels-cyber-idUSKCN10P0Z...

sullyj3 7y ago

This equation is missing a term for lost sales due to damage to public image.