5 ms·
I've started realizing this since the Exquifax breach. There is no point for companies to take security seriously because what the flip does it matter for them?
by hpoe 6y ago
I've started realizing this since the Exquifax breach. There is no point for companies to take security seriously because what the flip does it matter for them? They'll bohoo about how bad it was, fire their security people bring in new ones and nothing will change.
In short if you are in the security field at this point you aren't being brought in to secure or stop anything you're there for upper management to point the blame at when the attack does occur. Because spending money on security cuts into revenue and profits and unlike not investing in paying off technical debt this has no material consequences.
- wwright 6y agoSecurity deficiencies are technical debt
- hpoe 6y agoThey are technical debt with no monetary impact however. If my servers crash and I have downtime because customers can't use my website or product that's a problem. If I suffer a massive security breach and loose all of my customers personal information, I am not going to face any consequences.
- tickerticker 6y agoExcept for customers that drop you, eg, Target.
- PeterisP 6y agoThat's the whole point - if we look at the consequences of historical major breaches, they generally don't result in large number of customers actually leaving the company. And on some level that's even appropriate as generally the whole industry is vulnerable, it's reasonable to expect that the competitors have just as bad security as the breached company, they just didn't get breached because they weren't targeted by this particular attacker or because their breaches aren't (yet) detected or because they managed to hide and not publicize that breach. The 2013 data breach at Target is a good example of the worst case scenario because it was the first major widely publicised case, all the newer ones had far less effect because people start to understand that the breached company is not unique (like they thought in 2013 about Target) and even then they lost just ~2.5% of customers, and regained the customer confidence after 2-3 quarters. So even in the worst case scenario, 97.5% customers won't drop you, and any effect is short term, as the Target case demonstrates.
- genmud 6y agoAlso, with tech companies... growth is such a huge part of valuation and business plan that they will focus on acquiring new customers rather than retaining existing ones. If you are growing 5-10% quarter over quarter, loosing the 2.5% isn't really going to hurt that bad. It also is easy to explain churn if you have a breach, the board will go "oh, that makes sense" and move on.
- wwright 6y agoHave you heard of ransomware? Expired certificates? DDoS?
- bosswipe 6y agoThat's why I bought EFX stock on the dip after the hack, I knew there would be no consequence to their business. I've made 60% off of that bet, beating the S&P 500 over the same time frame.
- jkhdigital 6y agoThis comment is a fantastic window into just how distorted the world has become. (No shade being thrown; good on you for recognizing the opportunity and acting on it)
- rorykoehler 6y agoTangent: I've noticed very few people are able to separate personal positions from personal insights. Refreshing to see your insight and "no shade" acknowledgement here.
- rkuykendall-com 6y agoAnd today $SWI is still just barely under their IPO price, and not even at an all-time low.
- artursapek 6y agoThis is part of why I love working in the Bitcoin industry. Security there actually matters in a tangible way. Slipping on security can result in irreversible monetary theft of epic proportions. Potentially losing other peoples’ money is much higher stakes than losing their magic social security number.