4 ms·

If the building burns down you haven't given 100,000 of your customer's credit card numbers to the Russian mafia. Your building, and most of it's contents are

by modoc 18y ago

If the building burns down you haven't given 100,000 of your customer's credit card numbers to the Russian mafia. Your building, and most of it's contents are insured and replaceable.

tonystubblebine 18y ago
I'm pretty sure the business disruption of your HQ burning down is an order of magnitude greater than losing your customer's credit cards. On the credit card front, there are a number of processes that limit the damage. You can report the loss to both your customers and their card issuers. This will put them on alert for fraud and they can be issued new cards. Credit cards already come with fraud protection by default so none of your customers are actually on the hook for fraudulent activity. The greatest hit is probably taken by the merchants where the cards are used. During all of this, your business continues to run. On the fire front, in many cases business is effectively halted. Some people are setup to work remotely immediately, but do they have contact information for everyone they need to work with? Some people have no capacity for working remotely. It's almost guaranteed that you lose some data which has not been properly backed up. And then you spend some period of time replacing all of the things that made you want an office in the first place.
- modoc 18y ago
  You raise some good points, but the original question was specific to startups, so I'm making the assumption that 90% of the business really lives on hosted servers or is backed up on hosted servers somewhere else, and everyone has the ability to work from home on weekends, etc... On the credit card front you can only report the loss if you know about it. Lacking property security, audit trails, and alerting mechanisms, most people never know when their site's been compromised. Vast numbers of data theft incidents occur through SQL injection, exposed data files, plain-text user data being e-mailed around, etc... And you'll never know about it. Having proper security and encryption processes, rules, etc... makes a BIG difference. I'd also argue that for you and your 6 co-workers having the building burn down is a bigger deal than the data loss. But for your 100,000 customers having to deal with potential CC fraud and identity theft issues, is a MUCH bigger deal. Many cases of identity theft and associated credit and collections issues take YEARS to fix, if ever, and cause a great deal of hardship in the mean time. Your business can be up and running quicker than that.
  - tonystubblebine 18y ago
    Just to clarify. I told the fire story as an anecdote. Most startups should have neither a large HQ or 100k credit card numbers. But even if they did, there are more risks to the business than just hackers. The primary one is probably that nobody likes your product.

by modoc 18y ago

If the building burns down you haven't given 100,000 of your customer's credit card numbers to the Russian mafia. Your building, and most of it's contents are insured and replaceable.

tonystubblebine 18y ago

I'm pretty sure the business disruption of your HQ burning down is an order of magnitude greater than losing your customer's credit cards. On the credit card front, there are a number of processes that limit the damage. You can report the loss to both your customers and their card issuers. This will put them on alert for fraud and they can be issued new cards. Credit cards already come with fraud protection by default so none of your customers are actually on the hook for fraudulent activity. The greatest hit is probably taken by the merchants where the cards are used. During all of this, your business continues to run. On the fire front, in many cases business is effectively halted. Some people are setup to work remotely immediately, but do they have contact information for everyone they need to work with? Some people have no capacity for working remotely. It's almost guaranteed that you lose some data which has not been properly backed up. And then you spend some period of time replacing all of the things that made you want an office in the first place.

modoc 18y ago
You raise some good points, but the original question was specific to startups, so I'm making the assumption that 90% of the business really lives on hosted servers or is backed up on hosted servers somewhere else, and everyone has the ability to work from home on weekends, etc... On the credit card front you can only report the loss if you know about it. Lacking property security, audit trails, and alerting mechanisms, most people never know when their site's been compromised. Vast numbers of data theft incidents occur through SQL injection, exposed data files, plain-text user data being e-mailed around, etc... And you'll never know about it. Having proper security and encryption processes, rules, etc... makes a BIG difference. I'd also argue that for you and your 6 co-workers having the building burn down is a bigger deal than the data loss. But for your 100,000 customers having to deal with potential CC fraud and identity theft issues, is a MUCH bigger deal. Many cases of identity theft and associated credit and collections issues take YEARS to fix, if ever, and cause a great deal of hardship in the mean time. Your business can be up and running quicker than that.
- tonystubblebine 18y ago
  Just to clarify. I told the fire story as an anecdote. Most startups should have neither a large HQ or 100k credit card numbers. But even if they did, there are more risks to the business than just hackers. The primary one is probably that nobody likes your product.