10 ms·

After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if

by genmud 5y ago

After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if you can weather the storm, over the course of a year or two, there is effectively zero impact to your bottom line. You can also see this in the Solarwinds stock price. Year over year, they are down a hair under 4 percent... After being directly responsible for one of the most impactful cyber incidents yet. Hell, if you invested in January, after most of the stuff blew over, you would be up nearly 20% on your investment. There is even a perverse incentive to not do things and just get cyber insurance to cover you. Since these underwriters generally have no fucking clue what they are doing, you can actually make money on a cyber intrusion if you play your cards right. Only now that insurance companies have paid out the nose with ransomware incidents have they started to wise up. Having worked in the space, its absolutely bonkers what we accept as normal business practices with regards to cybersecurity.

CyberRage 5y ago
Honestly, I'm shocked by this comment. As if stock market is a perfect representation of a company performance, it is highly distorted\manipulated market. SolarWind is fucked, they have a massive drop in new customers, I work with dozens of companies that are now plan to completely abandon their suites(those things take time). Insurance is a trap. once you read the small letters, they don't fully cover the damage, usually only direct. Some have refused to pay due to some shady conditions that they insert into contracts to deceive customers(like any other insurance sector)
- bencollier49 5y ago
  If the stock market has distorted the price of SolarWinds that badly, as per your analysis, that's probably a sign that the stock market is massively overvaluing everything, and that we're headed for a gigantic crash. Which by coincidence is exactly what Michael Burry, the guy who predicted the 2008 housing crash, has been saying recently.
  - d3nj4l 5y ago
    I've been hearing the "we're headed for a crash" thing with the same logic since at least mid-2019. Either we're not heading for a crash, or the market has become so irrational that it doesn't even matter any more, and we can build castles in the air forever.
    - ClumsyPilot 5y ago
      In 2005 it was clear to some thay the market was heading for a crash, but it can take years.
    - KirillPanov 5y ago
      Mid-2019? We can definitely build castles in the air for two years.
    - doopy1 5y ago
      I believe the market should in theory rise with inflation. Doesn't seem too crazy all things considered.
  - rorykoehler 5y ago
    Isn't inflation above gains essentially a devaluing of the market? If the stock market goes slightly down and inflation ramps up significantly isn't that the same as a crash?
    - Bombthecat 5y ago
      The most expensive and valued stocks are "essentials" they dann just increase there price with inflation. I dont understand the problem with inflation..
      - betterunix2 5y ago
        Inflation is not a problem; unexpected changes in the rate of inflation are the problem. There are various reasons, but the most important is that a spike in the inflation rate leads to a spike in interest rates, which is generally harmful to businesses (loans are harder to repay, customers are less able to buy, etc.). There is also a second-order effect: rising interest rates reduce the value of long-dated bonds, which reduces the available investment capital (or worse, it can trigger margin calls and create a "contagion" effect).
- genmud 5y ago
  How is this comment shocking to you? I actually was using the stock price and public information on their earnings to make a point. The point being that no, these companies aren't losing customers in droves and if you look at their performance from a 3 or 5 year perspective, most breaches have had very little material impact on the companies. I disagree with you on SolarWinds being fucked... Sure, lots of folks are going to drop it, but they are closing new deals. The types of people that buy things like SolarWinds aren't buying the products because its a good technology. Not sure what insurance you have been looking at, but many of the larger businesses will essentially write out what they want covered (for example IR, infrastructure replacement due to hacking, business loss due to downtime, professional service implementation, support, PR assistance, etc.), and then the insurance company will come up with a price based on their calculations of risk. Sure, if an SMB goes and gets a "cyber policy" they are gonna be lots of technicalities, just like a mass market homeowners policy.
biztos 5y ago
> like fines and people going to jail for negligence Being bad at your job is not negligence, nor is underestimating the threat. It’d be nice to see consequences but I really don’t want to have the government locking people up for being well-paid fuck-ups. Don’t some of these companies have… shareholders?
- darkwater 5y ago
  If you screw it up with a building or a bridge, you might go to jail, and we as a society are fine with that. Why not in this case as well?
  - djrogers 5y ago
    It is 100% possible to be really good at InfoSec, do everything right, and still be breached. I think there’s a (very simplistic) view of IS, where it’s a black and white process of just engineering everything ’correctly’. It’s not like that in the real world…
    - genmud 5y ago
      Nobody is saying you should go to jail or get fined for getting owned by a 0day. I don't think that it is unreasonable to say that someone is negligent in having a CVE from 2014 unpatched, which then allows your customers to get compromised.
- lawtalkinghuman 5y ago
  > I really don’t want to have the government locking people up for being well-paid fuck-ups. If you go to a doctor and he fucks up: he (or his insurer) has to pay you. If he really fucks up, he ceases to be able to practice medicine. The same with nurses, lawyers, accountants, architects and other professionals. Software's much better—then they point to the "we take no liability for any errors" clause in the contract and everyone carries on as if nothing ever happened.
  - dlvktrsh 5y ago
Cullinet 5y ago
UK companies act hundreds of summary criminal offenses covering all aspects of corporate responsibility for any director. A 1977 case precedent established in the event that a director relies upon the advice of a accountant for making company directions, he or she will be liable to be banned from holding a directorship for life. The appeal failed. This is because the only essential role of a director is to be themselves a competent assessor of the company affairs. If you can't knobble the board of a UK limited liability company for letting go their own primary competitive asset (the more important consideration for the law designed to govern the behaviour of directors in fulfilling two goals : justify public indemnity to the extent of any shares they own in the company in the event of collapse ; and do their job without prejudice to the shareholders or the crown treasurer to pay negligence. Summary criminal charges are convicted on bringing proof and a judge not being shown disproof. Criminal intent doesn't come into it.
awsthro00945 5y ago
This isn't really true. Stock price is not an indicator of a company's "bottom line". As someone who helps respond to major breaches at big companies, these types of breaches often result in enormous expenditures on company-wide efforts to close security gaps or revamp processes. Either a regulatory agency, or more often the company's board of directors, will make a mandate to the C-suite that something must be done. Some of these expenditure campaigns are low-visibility, some even to the employees of the company, and they are usually not very sexy or noteworthy, so you won't read about them on the front page of CNN but they do happen and they are very costly to the company (in the ballparks of tens to hundreds of millions of dollars). I do think there should be harsher punishments in the form of fines, etc. But to say that there is "zero impact" just isn't true.
- atatatat 5y ago
  Share price doesn't regularly continue to go up while profits continue to contract.
- genmud 5y ago
  Dude, if you look at Equifaxes and Solarwinds EBITDA/earnings statements following their respective breaches, you will clearly see that there has been no major impact to their bottom line. Sure, expenses rise a bit for a short period of time, but these are not catastrophic by any means. I mean, I'm looking at Solarwinds last earnings statement and comparing quarters from last year to now, they are up about 3.5% in revenue (3/31/2020 vs 3/31/2021).
  - CyberRage 5y ago
    That doesn't mean anything. in such a year their products should have flown off the shelves. Remote monitoring\management? in COVID year? just 3.5% that's horrendous
    - faeyanpiraat 5y ago
      Are you sure about that? The customers who had experience with remote work and already knew that SW products would help them in this situation was a fixed number. The number of companies who had no clue about how to do remote work, and after haphazardly had to switch to it may still have no idea that you need to use products provided by SW. Also do you really need any of that to do remote work? Of course not.
OpieCunningham 5y ago
“After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if you can weather the storm, over the course of a year or two, there is effectively zero impact to your bottom line.” It’s even worse than just weathering a storm. Lax security has been incentivized. The Equifax CEO, Richard Smith, stepped down shortly after the public became aware of the breach, with a $90m severance package. https://fortune.com/2017/09/26/equifax-ceo-richard-smith-net-worth/ https://fortune.com/2017/09/26/equifax-ceo-richard-smith-net...
- TheOtherHobbes 5y ago
  It's almost as if making shareholder returns and CEO pay the only indicator of company success creates terrible consequences.
  - papito 5y ago
    Juice the returns at all costs for a few quarters and then walk away with riches from total ruins, you say?
    - tudorw 5y ago
      This is the way.
  - koheripbal 5y ago
    Long term shareholder returns are directly correlated to the long term company success. It's always such an odd criticism to think of "shareholder returns" as a pejorative.
    - seventytwo 5y ago
      They key is long-term…
    - specialist 5y ago
      TheOtherHobbes said "only", as in "to the exclusion of all other concerns". Where's the pejorative?
toe55 5y ago
It's not bonkers. We have 20-30 years of data on cyber attacks and Cybersecurity is not that important - https://ubiquity.acm.org/article.cfm?id=3333611 https://ubiquity.acm.org/article.cfm?id=3333611 Larger the dumps get the harder they are to exploit or do serious damage. I can hand you all my orgs data and 200 people who work with it everyday and it will still take you years to figure out what anything means.
- kaba0 5y ago
  Until it hits something important.. also, data breaches are just one form of cyber attacks.
- Cullinet 5y ago
  We have operating systems for which remarkably few known exploits have ever been found. VMS now "open" and recently running in a VM on Xeons. I have always suspected that the silence that resounded suddenly about security prowess of VMS coincided with the release of extensive POSIX compatibility layers and the vaunted ports of years old open source nix wares as a excuse to play buzzword bingo at that time. But anyone writing a native VMS application I'd firmly embraced by a deep architecture designed to provide accounts for the time when DEC silicon and their own leading fab was creating a explosion in processing power and the number of users capable of being supported by a OS that has still incredibly well integrated system programming tool chain languages including Digital BASIC that can do about anything BLISS can low level. This virtually (sorry) made it a overnight imperative to get the security right and tight. Alpha had hardware security rings almost certainly to give VMS the chance to serve the maximum number of users and steal account wins.
- rightbyte 5y ago
  > I can hand you all my orgs data and 200 people who work with it everyday and it will still take you years to figure out what anything means. Ye what are you supposed to do with the information. I worked at a place that is paranoid for data leaks of non personal data, like source code. Even if their direct competitor got the sources they would have almost no use for it since it is an undocumented mess. The source without the dev. departments is useless. The same applies for business strategy if it leaks. Which competitor is nimble enought to change anything based on that data.
elorant 5y ago
Hell, if you invested in January, after most of the stuff blew over, you would be up nearly 20% on your investment. Yeap, I did that with Ubiquity after their incident. Bought at $275 and the stock now is 12% higher. Seems like a good strategy, and I'm looking forward for similar incidents in the future.
zie 5y ago
> Only now that insurance companies have paid out the nose with ransomware incidents have they started to wise up. Exactly right, and eventually they will GET A CLUE, and require serious security audits to get a sane price on incident insurance. Otherwise they will make you pay gobs and gobs of money, and it will just be cheaper to be sane about your security posture. Otherwise there is zero incentive for the insurance companies to keep paying out the nose on policies they aren't making money from. This has happened to police stations, as they get mismanaged by idiot police chiefs, the insurance providers say.. uh we aren't going to insure you anymore unless you fix your sh*t. As but one example: https://www.theatlantic.com/politics/archive/2017/06/insurance-companies-police/529833/ https://www.theatlantic.com/politics/archive/2017/06/insuran... I see this happening to cyper security policies also, they(insurance companies) will wise up or go broke.
nogbit 5y ago
The insurance is a joke. I’ve seen requirements from companies that we want to do professional services for that require us to carry $5mil in cyber insurance, but nothing at all mentioned as to requirements on security governance and or policies/procedures. Nothing will change until government regulates it. Same with auto, airlines and rail. They did not make their products and services safer by choice, they were regulated to do so.
miohtama 5y ago
We do not see a change until shareholders truly get hurt and stock price dives because of neglience. Investors would be suddenly interested in cybersecurity. But I do not what would be the best mechanism to cause this.
tomComb 5y ago
I was shocked at how minimal the impact was on Garmin, given that their customers are consumers who are trusting them with very personal data.
elipsey 5y ago
hypothesis: security failure by a service provider is evidence of winning at externalizing costs. strategy: find SaaS corps responsible for catastrophic cyber-attacks and buy them on the the dip?
swiley 5y ago
I've always said: "There's surprisingly little money in correct software."

by genmud 5y ago

CyberRage 5y ago

Honestly, I'm shocked by this comment. As if stock market is a perfect representation of a company performance, it is highly distorted\manipulated market. SolarWind is fucked, they have a massive drop in new customers, I work with dozens of companies that are now plan to completely abandon their suites(those things take time). Insurance is a trap. once you read the small letters, they don't fully cover the damage, usually only direct. Some have refused to pay due to some shady conditions that they insert into contracts to deceive customers(like any other insurance sector)

bencollier49 5y ago
If the stock market has distorted the price of SolarWinds that badly, as per your analysis, that's probably a sign that the stock market is massively overvaluing everything, and that we're headed for a gigantic crash. Which by coincidence is exactly what Michael Burry, the guy who predicted the 2008 housing crash, has been saying recently.
- d3nj4l 5y ago
  I've been hearing the "we're headed for a crash" thing with the same logic since at least mid-2019. Either we're not heading for a crash, or the market has become so irrational that it doesn't even matter any more, and we can build castles in the air forever.
  - ClumsyPilot 5y ago
    In 2005 it was clear to some thay the market was heading for a crash, but it can take years.
  - KirillPanov 5y ago
    Mid-2019? We can definitely build castles in the air for two years.
  - doopy1 5y ago
    I believe the market should in theory rise with inflation. Doesn't seem too crazy all things considered.
- rorykoehler 5y ago
  Isn't inflation above gains essentially a devaluing of the market? If the stock market goes slightly down and inflation ramps up significantly isn't that the same as a crash?
  - Bombthecat 5y ago
    The most expensive and valued stocks are "essentials" they dann just increase there price with inflation. I dont understand the problem with inflation..
    - betterunix2 5y ago
      Inflation is not a problem; unexpected changes in the rate of inflation are the problem. There are various reasons, but the most important is that a spike in the inflation rate leads to a spike in interest rates, which is generally harmful to businesses (loans are harder to repay, customers are less able to buy, etc.). There is also a second-order effect: rising interest rates reduce the value of long-dated bonds, which reduces the available investment capital (or worse, it can trigger margin calls and create a "contagion" effect).
genmud 5y ago
How is this comment shocking to you? I actually was using the stock price and public information on their earnings to make a point. The point being that no, these companies aren't losing customers in droves and if you look at their performance from a 3 or 5 year perspective, most breaches have had very little material impact on the companies. I disagree with you on SolarWinds being fucked... Sure, lots of folks are going to drop it, but they are closing new deals. The types of people that buy things like SolarWinds aren't buying the products because its a good technology. Not sure what insurance you have been looking at, but many of the larger businesses will essentially write out what they want covered (for example IR, infrastructure replacement due to hacking, business loss due to downtime, professional service implementation, support, PR assistance, etc.), and then the insurance company will come up with a price based on their calculations of risk. Sure, if an SMB goes and gets a "cyber policy" they are gonna be lots of technicalities, just like a mass market homeowners policy.

biztos 5y ago

> like fines and people going to jail for negligence Being bad at your job is not negligence, nor is underestimating the threat. It’d be nice to see consequences but I really don’t want to have the government locking people up for being well-paid fuck-ups. Don’t some of these companies have… shareholders?

darkwater 5y ago
If you screw it up with a building or a bridge, you might go to jail, and we as a society are fine with that. Why not in this case as well?
- djrogers 5y ago
  It is 100% possible to be really good at InfoSec, do everything right, and still be breached. I think there’s a (very simplistic) view of IS, where it’s a black and white process of just engineering everything ’correctly’. It’s not like that in the real world…
  - genmud 5y ago
    Nobody is saying you should go to jail or get fined for getting owned by a 0day. I don't think that it is unreasonable to say that someone is negligent in having a CVE from 2014 unpatched, which then allows your customers to get compromised.
lawtalkinghuman 5y ago
> I really don’t want to have the government locking people up for being well-paid fuck-ups. If you go to a doctor and he fucks up: he (or his insurer) has to pay you. If he really fucks up, he ceases to be able to practice medicine. The same with nurses, lawyers, accountants, architects and other professionals. Software's much better—then they point to the "we take no liability for any errors" clause in the contract and everyone carries on as if nothing ever happened.
- dlvktrsh 5y ago

Cullinet 5y ago

UK companies act hundreds of summary criminal offenses covering all aspects of corporate responsibility for any director. A 1977 case precedent established in the event that a director relies upon the advice of a accountant for making company directions, he or she will be liable to be banned from holding a directorship for life. The appeal failed. This is because the only essential role of a director is to be themselves a competent assessor of the company affairs. If you can't knobble the board of a UK limited liability company for letting go their own primary competitive asset (the more important consideration for the law designed to govern the behaviour of directors in fulfilling two goals : justify public indemnity to the extent of any shares they own in the company in the event of collapse ; and do their job without prejudice to the shareholders or the crown treasurer to pay negligence. Summary criminal charges are convicted on bringing proof and a judge not being shown disproof. Criminal intent doesn't come into it.

awsthro00945 5y ago

This isn't really true. Stock price is not an indicator of a company's "bottom line". As someone who helps respond to major breaches at big companies, these types of breaches often result in enormous expenditures on company-wide efforts to close security gaps or revamp processes. Either a regulatory agency, or more often the company's board of directors, will make a mandate to the C-suite that something must be done. Some of these expenditure campaigns are low-visibility, some even to the employees of the company, and they are usually not very sexy or noteworthy, so you won't read about them on the front page of CNN but they do happen and they are very costly to the company (in the ballparks of tens to hundreds of millions of dollars). I do think there should be harsher punishments in the form of fines, etc. But to say that there is "zero impact" just isn't true.

atatatat 5y ago
Share price doesn't regularly continue to go up while profits continue to contract.
genmud 5y ago
Dude, if you look at Equifaxes and Solarwinds EBITDA/earnings statements following their respective breaches, you will clearly see that there has been no major impact to their bottom line. Sure, expenses rise a bit for a short period of time, but these are not catastrophic by any means. I mean, I'm looking at Solarwinds last earnings statement and comparing quarters from last year to now, they are up about 3.5% in revenue (3/31/2020 vs 3/31/2021).
- CyberRage 5y ago
  That doesn't mean anything. in such a year their products should have flown off the shelves. Remote monitoring\management? in COVID year? just 3.5% that's horrendous
  - faeyanpiraat 5y ago
    Are you sure about that? The customers who had experience with remote work and already knew that SW products would help them in this situation was a fixed number. The number of companies who had no clue about how to do remote work, and after haphazardly had to switch to it may still have no idea that you need to use products provided by SW. Also do you really need any of that to do remote work? Of course not.

OpieCunningham 5y ago

“After the Equifax breach, everyone learned that until there are actual repercussions for cyber attacks (like fines and people going to jail for negligence), if you can weather the storm, over the course of a year or two, there is effectively zero impact to your bottom line.” It’s even worse than just weathering a storm. Lax security has been incentivized. The Equifax CEO, Richard Smith, stepped down shortly after the public became aware of the breach, with a $90m severance package. https://fortune.com/2017/09/26/equifax-ceo-richard-smith-net-worth/ https://fortune.com/2017/09/26/equifax-ceo-richard-smith-net...

TheOtherHobbes 5y ago
It's almost as if making shareholder returns and CEO pay the only indicator of company success creates terrible consequences.
- papito 5y ago
  Juice the returns at all costs for a few quarters and then walk away with riches from total ruins, you say?
  - tudorw 5y ago
    This is the way.
- koheripbal 5y ago
  Long term shareholder returns are directly correlated to the long term company success. It's always such an odd criticism to think of "shareholder returns" as a pejorative.
  - seventytwo 5y ago
    They key is long-term…
  - specialist 5y ago
    TheOtherHobbes said "only", as in "to the exclusion of all other concerns". Where's the pejorative?

toe55 5y ago

It's not bonkers. We have 20-30 years of data on cyber attacks and Cybersecurity is not that important - https://ubiquity.acm.org/article.cfm?id=3333611 https://ubiquity.acm.org/article.cfm?id=3333611 Larger the dumps get the harder they are to exploit or do serious damage. I can hand you all my orgs data and 200 people who work with it everyday and it will still take you years to figure out what anything means.

kaba0 5y ago
Until it hits something important.. also, data breaches are just one form of cyber attacks.
Cullinet 5y ago
We have operating systems for which remarkably few known exploits have ever been found. VMS now "open" and recently running in a VM on Xeons. I have always suspected that the silence that resounded suddenly about security prowess of VMS coincided with the release of extensive POSIX compatibility layers and the vaunted ports of years old open source nix wares as a excuse to play buzzword bingo at that time. But anyone writing a native VMS application I'd firmly embraced by a deep architecture designed to provide accounts for the time when DEC silicon and their own leading fab was creating a explosion in processing power and the number of users capable of being supported by a OS that has still incredibly well integrated system programming tool chain languages including Digital BASIC that can do about anything BLISS can low level. This virtually (sorry) made it a overnight imperative to get the security right and tight. Alpha had hardware security rings almost certainly to give VMS the chance to serve the maximum number of users and steal account wins.
rightbyte 5y ago
> I can hand you all my orgs data and 200 people who work with it everyday and it will still take you years to figure out what anything means. Ye what are you supposed to do with the information. I worked at a place that is paranoid for data leaks of non personal data, like source code. Even if their direct competitor got the sources they would have almost no use for it since it is an undocumented mess. The source without the dev. departments is useless. The same applies for business strategy if it leaks. Which competitor is nimble enought to change anything based on that data.

elorant 5y ago

Hell, if you invested in January, after most of the stuff blew over, you would be up nearly 20% on your investment. Yeap, I did that with Ubiquity after their incident. Bought at $275 and the stock now is 12% higher. Seems like a good strategy, and I'm looking forward for similar incidents in the future.

zie 5y ago

> Only now that insurance companies have paid out the nose with ransomware incidents have they started to wise up. Exactly right, and eventually they will GET A CLUE, and require serious security audits to get a sane price on incident insurance. Otherwise they will make you pay gobs and gobs of money, and it will just be cheaper to be sane about your security posture. Otherwise there is zero incentive for the insurance companies to keep paying out the nose on policies they aren't making money from. This has happened to police stations, as they get mismanaged by idiot police chiefs, the insurance providers say.. uh we aren't going to insure you anymore unless you fix your sh*t. As but one example: https://www.theatlantic.com/politics/archive/2017/06/insurance-companies-police/529833/ https://www.theatlantic.com/politics/archive/2017/06/insuran... I see this happening to cyper security policies also, they(insurance companies) will wise up or go broke.

nogbit 5y ago

The insurance is a joke. I’ve seen requirements from companies that we want to do professional services for that require us to carry $5mil in cyber insurance, but nothing at all mentioned as to requirements on security governance and or policies/procedures. Nothing will change until government regulates it. Same with auto, airlines and rail. They did not make their products and services safer by choice, they were regulated to do so.

miohtama 5y ago

We do not see a change until shareholders truly get hurt and stock price dives because of neglience. Investors would be suddenly interested in cybersecurity. But I do not what would be the best mechanism to cause this.

tomComb 5y ago

I was shocked at how minimal the impact was on Garmin, given that their customers are consumers who are trusting them with very personal data.

elipsey 5y ago

hypothesis: security failure by a service provider is evidence of winning at externalizing costs. strategy: find SaaS corps responsible for catastrophic cyber-attacks and buy them on the the dip?

swiley 5y ago

I've always said: "There's surprisingly little money in correct software."