3 ms·

To what standard should security be increased? Should we introduce legislation requiring companies to spend some percentage of their turnover on data security?

To what standard should security be increased? Should we introduce legislation requiring companies to spend some percentage of their turnover on data security? Or should we require compliance with an ISO standard? Or just put companies on the hook for all breach-related costs? As you can imagine, for the legislator, this is quite a headache. The insurance idea is appealing because it lets the market price the risk, and introduces a mechanism that can adapt to changing conditions. What mechanism do you propose to induce companies to fix their security?

kebman 6y ago
> Should we introduce legislation requiring companies to spend some percentage of their turnover on data security? Does that seem like a good idea to you? > Or should we require compliance with an ISO standard? Or just put companies on the hook for all breach-related costs? Companies are already doing a combination of the two. > As you can imagine, for the legislator, this is quite a headache. Why? Legislators don't need to get involved at all, outside making sure that justice is served to the criminals, and that injured parties are duly compensated. > The insurance idea is appealing because it lets the market price the risk, and introduces a mechanism that can adapt to changing conditions. Sure, if the advantage of it defeats the severe problems already stated, and then only if it costs less than to simply invest in better security (or in the least that it doesn't lower the margin enough to hamper such improvements). > To what standard should security be increased? (...) What mechanism do you propose to induce companies to fix their security? That's up to the company. None of them wish the bad reputation of causing their own patients harm, immaterial or otherwise. Even so, most countries also have data security laws in place. For instance, where I'm from, patient data is regulated to avoid data loss that injures patients, for example by requiring certain forms of encryption, and (strictly) limiting who is allowed to handle certain data. On top of that are personal privacy laws, and patient safety laws, also particulary pertaining to patient data. Failure to follow these rules incurrs fines or at worst jail, especially if it's due to lacking security, too many open attack vectors, public or easy access to areas that should otherwise have been locked, etc.

kebman 6y ago

> Should we introduce legislation requiring companies to spend some percentage of their turnover on data security? Does that seem like a good idea to you? > Or should we require compliance with an ISO standard? Or just put companies on the hook for all breach-related costs? Companies are already doing a combination of the two. > As you can imagine, for the legislator, this is quite a headache. Why? Legislators don't need to get involved at all, outside making sure that justice is served to the criminals, and that injured parties are duly compensated. > The insurance idea is appealing because it lets the market price the risk, and introduces a mechanism that can adapt to changing conditions. Sure, if the advantage of it defeats the severe problems already stated, and then only if it costs less than to simply invest in better security (or in the least that it doesn't lower the margin enough to hamper such improvements). > To what standard should security be increased? (...) What mechanism do you propose to induce companies to fix their security? That's up to the company. None of them wish the bad reputation of causing their own patients harm, immaterial or otherwise. Even so, most countries also have data security laws in place. For instance, where I'm from, patient data is regulated to avoid data loss that injures patients, for example by requiring certain forms of encryption, and (strictly) limiting who is allowed to handle certain data. On top of that are personal privacy laws, and patient safety laws, also particulary pertaining to patient data. Failure to follow these rules incurrs fines or at worst jail, especially if it's due to lacking security, too many open attack vectors, public or easy access to areas that should otherwise have been locked, etc.