5 ms·

We have self regulation available via NIST 800-53, NIST 800-30, SOC2, mandatory in some contexts like FISMA, etc. What is now guidance can become mandatory audi

We have self regulation available via NIST 800-53, NIST 800-30, SOC2, mandatory in some contexts like FISMA, etc. What is now guidance can become mandatory audits with the stroke of a congressional pen. I sound like a broken record but it bears repeating: Most of these attacks are successful because companies neglect best practices. Whitelisting, security awareness training, UEBA, etc go a long way. I would hope the free market would prune companies without proper cybersecurity but regulatory capture means it probably won’t. Equifax and its executives are doing just fine.

cosmodisk 5y ago
That's the problem that free market prefers companies that have 100 bigger budgets for marketing than security teams. Unless this changes, nothing will change.
- afrodc_ 5y ago
  The markets aren't always rational but a slew of security flaws increasing the drain of revenue by having to pay out ransomware or losing all of your data will be a driving force behind improving security.
  - mcguire 5y ago
    The true skill of choosing ransoms is to make sure that it's high enough to compensate you for the risk you take, but low enough to the other options are unappealing to the victim. Large businesses can trivially set aside a few million dollars per year for ransoms. Small businesses don't have the ability to change the system.
    - afrodc_ 5y ago
      That's a very good point. In that same vein, I do wonder if the hostage takers are that aware of the implications of their actions without letting greed guide them, not being a cohesive organization themselves.
throwawaygh 5y ago
> I would hope the free market would prune companies without proper cybersecurity but regulatory capture Three things. 1. Markets have a slow reaction function, and it really is a reaction function. Let's Consider Equifax. Suppose that market were competitive. Then you'd have dozens or even hundreds of firms with all of that data that Equifax leaked. It seems unlikely that having more copies of data floating around more firms would decrease the risk of a breach. By the time the market signals, the damage is already done, and Equifax going out of business does diddly squat for impacted consumers. 2. Markets also have perverse incentives. Data breaches, in particular, are not necessarily expensive. I've been affected by at least a dozen, none of which had a material impact on the company that lost my data. None of those companies except equifax is subject to any sort of monopolistic forces. Some, like dropbox, are basically commodities. This might be different in the case of Kaseya and Solar Winds, which are effectively IT security outsourcing firms. Maybe. We'll see. If both of those firms continue to exist at similar scale, then the hypothesis that markets can do literally anything about IT security is completely discredited. 3. Equifax is definitely a monopoly/triopoly, but the situation is much closer to cartel behavior than regulatory capture.
mcguire 5y ago
The system as it exists now runs open-loop. There are no particular consequences to companies, executives, or developers not to ignore "best practices", and there are no particular benefits of following them. Society expects technology to "move fast and break things", at least until the consequences get too visible. And we're not there yet.

cosmodisk 5y ago

That's the problem that free market prefers companies that have 100 bigger budgets for marketing than security teams. Unless this changes, nothing will change.

afrodc_ 5y ago
The markets aren't always rational but a slew of security flaws increasing the drain of revenue by having to pay out ransomware or losing all of your data will be a driving force behind improving security.
- mcguire 5y ago
  The true skill of choosing ransoms is to make sure that it's high enough to compensate you for the risk you take, but low enough to the other options are unappealing to the victim. Large businesses can trivially set aside a few million dollars per year for ransoms. Small businesses don't have the ability to change the system.
  - afrodc_ 5y ago
    That's a very good point. In that same vein, I do wonder if the hostage takers are that aware of the implications of their actions without letting greed guide them, not being a cohesive organization themselves.

throwawaygh 5y ago

> I would hope the free market would prune companies without proper cybersecurity but regulatory capture Three things. 1. Markets have a slow reaction function, and it really is a reaction function. Let's Consider Equifax. Suppose that market were competitive. Then you'd have dozens or even hundreds of firms with all of that data that Equifax leaked. It seems unlikely that having more copies of data floating around more firms would decrease the risk of a breach. By the time the market signals, the damage is already done, and Equifax going out of business does diddly squat for impacted consumers. 2. Markets also have perverse incentives. Data breaches, in particular, are not necessarily expensive. I've been affected by at least a dozen, none of which had a material impact on the company that lost my data. None of those companies except equifax is subject to any sort of monopolistic forces. Some, like dropbox, are basically commodities. This might be different in the case of Kaseya and Solar Winds, which are effectively IT security outsourcing firms. Maybe. We'll see. If both of those firms continue to exist at similar scale, then the hypothesis that markets can do literally anything about IT security is completely discredited. 3. Equifax is definitely a monopoly/triopoly, but the situation is much closer to cartel behavior than regulatory capture.

mcguire 5y ago

The system as it exists now runs open-loop. There are no particular consequences to companies, executives, or developers not to ignore "best practices", and there are no particular benefits of following them. Society expects technology to "move fast and break things", at least until the consequences get too visible. And we're not there yet.