2 ms·

So why, then, do you think that incentives that have nothing to do with the average consumer are sufficient? The average consumer is still helpless here. They s

So why, then, do you think that incentives that have nothing to do with the average consumer are sufficient? The average consumer is still helpless here. They simply cannot know if a company has good security or not, especially if its new - like a startup. The end result is that most of them assume that all security is bad. We have seen this before, repeatedly, and its even showing up in the comments of HN: http://news.ycombinator.com/item?id=2671441 http://news.ycombinator.com/item?id=2671441 People keep asking if good security is even practical. Security experts know it is, but nobody else does. If the incentives you describe were actually working, we would be properly assigning blame to bad security, instead of everyone simply asking if good security is even possible.

m0nastic 15y ago
I'm sorry if my post led you to believe that I think the incentives are presently sufficient. They most certainly are not. My point was that they exist, and believe it or not, as bad as they seem now, they are better than they were when I first started working in InfoSec ten years ago. I'm not a "visionary" type person, but the only incentive that I can think of that would actually have practical implications for the consumer would be the ability to hold a provider responsible for bad security decisions (ie: Your site was hacked, my information was compromised, so now I'm suing you). I also don't think this will ever happen (on a large enough scale to be effective); for a variety of reasons. I know this sounds stupidly obvious, but companies on the whole will only take security seriously when the cost from being insecure is greater than the cost it will take them to secure things. Maybe insurance will be the thing to finally tip the scale. Companies are already buying "hacker insurance", and I imagine if there's any industry with an incentive to enforce best practices, it would be the insurance industry.
- blackhole 15y ago
  I am convinced that something will have to happen, and I agree that the insurance deal sounds promising. Companies will be forced to have good security if they want good insurance.

m0nastic 15y ago

I'm sorry if my post led you to believe that I think the incentives are presently sufficient. They most certainly are not. My point was that they exist, and believe it or not, as bad as they seem now, they are better than they were when I first started working in InfoSec ten years ago. I'm not a "visionary" type person, but the only incentive that I can think of that would actually have practical implications for the consumer would be the ability to hold a provider responsible for bad security decisions (ie: Your site was hacked, my information was compromised, so now I'm suing you). I also don't think this will ever happen (on a large enough scale to be effective); for a variety of reasons. I know this sounds stupidly obvious, but companies on the whole will only take security seriously when the cost from being insecure is greater than the cost it will take them to secure things. Maybe insurance will be the thing to finally tip the scale. Companies are already buying "hacker insurance", and I imagine if there's any industry with an incentive to enforce best practices, it would be the insurance industry.

blackhole 15y ago
I am convinced that something will have to happen, and I agree that the insurance deal sounds promising. Companies will be forced to have good security if they want good insurance.