3 ms·

> ou are arguing for behavior without providing any suggestions on how to achieve it. (sic.) Yes, I did. I provided you with this solution: "simply invest that

by kebman 6y ago

> ou are arguing for behavior without providing any suggestions on how to achieve it. (sic.) Yes, I did. I provided you with this solution: "simply invest that money in better security to begin with" > "Wouldn't it be better to simply do the right thing." is not a solution. I never said that. But what I did say is indeed a solution. > What I propose is a set of policies and incentives that archive what you want. Well, it certainly makes incentives, but probably not the ones you had in mind. For instance it incentivizes middlemen to scrape off valuable resources that could have been used to secure the actual data. At best this lowers the profit margin left over for the hospital to improve the security, but it's way worse than that. Instead the middleman actually incentivizes hackers to crack into the very system the middleman "insures," exactly because huge insurance payouts are involved. Perhaps the hackers could fake a mental disorder and get committed at the hospital, which would make it far easier to get insight into how the data security system works, and then plant a backdoor or leak that way. This means the hacker would both get money from blackmail and money from insurance payouts (win-win for him), making the incentives from the insurance scam absurdly bad. But perhaps that was the goal all along? Meanwhile the owner is already disincentivized from securing the system further, because he can claim that he already did enough to secure it, while what he actually means is that he insured it... Whatever he paid for, was certainly not free! The only one incentivized to look into the matter, is the insurance company itself, because they're the ones who stand to lose the most money if the system fails. And even they don't want to waste money on a matter they might not even understand themselves. Meanwile their biggest incentive isn't to secure the data, but to not pay money to the patients. And perhaps the easiest way to avoid that, is to hire a PR consultant instead of fixing the data system. Certainly the least of their worries are the patients, who are the real losers here, from being trapped in a game of exploitation for profit, and who quite possibly have to pay a much higher fee for the services of said institution because of it. Luckily, Finland is a welfare state, so that extra cost probably won't be billed individual patients (depending on how this privately owned hospital operates), but instead it will most likely be forwarded to the taxpayers, which – while spreading the cost on more hands – is still extremely bad. Overall, introducing an insurance scheme only adds another problem, without fixing the initial one, because how would you rate the probability of the system failing? That's what sets the insurance fee, after all. Thus, for the insurance companys part, it's far better to overbill, which would just result in increasing cost, without much benefit to anyone.

rebuilder 6y ago
To what standard should security be increased? Should we introduce legislation requiring companies to spend some percentage of their turnover on data security? Or should we require compliance with an ISO standard? Or just put companies on the hook for all breach-related costs? As you can imagine, for the legislator, this is quite a headache. The insurance idea is appealing because it lets the market price the risk, and introduces a mechanism that can adapt to changing conditions. What mechanism do you propose to induce companies to fix their security?
- kebman 6y ago
  > Should we introduce legislation requiring companies to spend some percentage of their turnover on data security? Does that seem like a good idea to you? > Or should we require compliance with an ISO standard? Or just put companies on the hook for all breach-related costs? Companies are already doing a combination of the two. > As you can imagine, for the legislator, this is quite a headache. Why? Legislators don't need to get involved at all, outside making sure that justice is served to the criminals, and that injured parties are duly compensated. > The insurance idea is appealing because it lets the market price the risk, and introduces a mechanism that can adapt to changing conditions. Sure, if the advantage of it defeats the severe problems already stated, and then only if it costs less than to simply invest in better security (or in the least that it doesn't lower the margin enough to hamper such improvements). > To what standard should security be increased? (...) What mechanism do you propose to induce companies to fix their security? That's up to the company. None of them wish the bad reputation of causing their own patients harm, immaterial or otherwise. Even so, most countries also have data security laws in place. For instance, where I'm from, patient data is regulated to avoid data loss that injures patients, for example by requiring certain forms of encryption, and (strictly) limiting who is allowed to handle certain data. On top of that are personal privacy laws, and patient safety laws, also particulary pertaining to patient data. Failure to follow these rules incurrs fines or at worst jail, especially if it's due to lacking security, too many open attack vectors, public or easy access to areas that should otherwise have been locked, etc.

by kebman 6y ago

rebuilder 6y ago

To what standard should security be increased? Should we introduce legislation requiring companies to spend some percentage of their turnover on data security? Or should we require compliance with an ISO standard? Or just put companies on the hook for all breach-related costs? As you can imagine, for the legislator, this is quite a headache. The insurance idea is appealing because it lets the market price the risk, and introduces a mechanism that can adapt to changing conditions. What mechanism do you propose to induce companies to fix their security?

kebman 6y ago
> Should we introduce legislation requiring companies to spend some percentage of their turnover on data security? Does that seem like a good idea to you? > Or should we require compliance with an ISO standard? Or just put companies on the hook for all breach-related costs? Companies are already doing a combination of the two. > As you can imagine, for the legislator, this is quite a headache. Why? Legislators don't need to get involved at all, outside making sure that justice is served to the criminals, and that injured parties are duly compensated. > The insurance idea is appealing because it lets the market price the risk, and introduces a mechanism that can adapt to changing conditions. Sure, if the advantage of it defeats the severe problems already stated, and then only if it costs less than to simply invest in better security (or in the least that it doesn't lower the margin enough to hamper such improvements). > To what standard should security be increased? (...) What mechanism do you propose to induce companies to fix their security? That's up to the company. None of them wish the bad reputation of causing their own patients harm, immaterial or otherwise. Even so, most countries also have data security laws in place. For instance, where I'm from, patient data is regulated to avoid data loss that injures patients, for example by requiring certain forms of encryption, and (strictly) limiting who is allowed to handle certain data. On top of that are personal privacy laws, and patient safety laws, also particulary pertaining to patient data. Failure to follow these rules incurrs fines or at worst jail, especially if it's due to lacking security, too many open attack vectors, public or easy access to areas that should otherwise have been locked, etc.