5 ms·
If the US were to be serious about corporate IT security, they'd empower and indemnify DoD, NSA, private industry red teams to pentest against everything with a
by ethbr0 6y ago
If the US were to be serious about corporate IT security, they'd empower and indemnify DoD, NSA, private industry red teams to pentest against everything with a US point of presence or customers, using commercial available / in the wild methods.
This would have the beneficial side effect of flushing all the incompetent paper-pushers / requirement-box-checkers out of the security industry.
If you're found vulnerable, that's a fine. If something gets accidentally broken in the exercise, that's the price of commitment.
Nothing is going to change until you increase the frequency / likelihood of breaches for these companies. If it's a yearly cost, it gets addressed. If it's a catastrophic possibility, it gets ignored.
- Miner49er 6y agoThe market has already solved this in the form of ransomware groups. No need to have the government do it and issue a fine, ransomware groups literally are doing what you said. I guess the government could legalize ransomware hacking to encourage it, but that'll never happen.
- beardbandit 6y agoI'd rather the money and fines flow to the US government, not random hacker groups.
- meepmorp 6y agoBut the hacker groups let me pay in crypto.
- rini17 6y agoThey could do it indirectly, by requiring insurance against security holes.
- kingaillas 6y ago>If the US were to be serious about corporate IT security What happened to the responsibility of corporations for corporate security? Including corporations that are the victims of attacks, and corporations that sell buggy operating systems and applications? Why does the government have to provide the red teams? The general attitude is all government agencies are wasteful and incompetent, except in this circumstance where the wealthiest corporations in the history of the world apparently can't spend enough to fix their own crap. But the government not only can but should?? This just sounds like externalizing costs to the public while banking record private profits. How about rather than subsidizing software corporations we talk about liability laws and fines, like any other physical industry that releases dangerous, broken products. Or an insurance system that is funded by a portion of the profits the software industry makes. Then we're actually making the software vendors feel some pain which will incentivize them to release higher quality code.
- miohtama 6y ago“Too big to fail” and investors do not get hurt. The problem does not fix itself until the investors start truly losing money, the care, unlike the Equifax case. Until the portfolio value cannot go down 90% there is not going to be a change in corporate actionism.
- rawtxapp 6y agoThey are starting to lose money, it's 5M$ today, who knows what it'll be tomorrow or how often it's going to happen.
- dredmorbius 6y agoSelf-regulation doesn't.
- erosenbe0 6y agoAgree. The govt need not provide the teams as they must compete for talent like anyone else and don't have much to spare. The govt only has a relative abundance of talent [largely interspersed with its contractors] in highly regulated activites like making nuclear weapons, where private entities don't participate.
- fiter 6y agoOne of the functions of the government is to educate and train its population. I think using that function could resolve the shortage or high cost of talent.
- mensetmanusman 6y agoDo corporations defend their factories with their own weapons?
- R0b0t1 6y agoWell, they can. Interesting thought.
- 6y ago