4 ms·

I don't think that's gonna cut it, but definitely on the right track. Its going to require some kind of legislation, or an insurance requirement that renders th

I don't think that's gonna cut it, but definitely on the right track. Its going to require some kind of legislation, or an insurance requirement that renders the insurers as de-facto regulators. This is still crazy hard due to the possibility of regulatory arbitrage, just open shop in Anguilla or wherever. Without the auditing, compliance, and domain experts to verify and implement this, its going to be extremely hard to create and levy these penalties in any meaningful way. Using (legally) vague terms like "leak" "personal" "data" and "involved", a quick trip to the local courtroom will obviate a lot of the fines for well connected C-execs and legal teams. Data integrity needs to be baked into the equation from the start. Until it is a business requirement to ensure proper system architecture practices, data integrity, and auditing, I don't see a snowball's chance of reaching sanity. Really, we've only barely defined the problem. Businesses have compliance departments that are totally subservient to business needs and would much rather resort to gaslighting stakeholders with silver-bullet checkbox security technology processes shaded in at the board room. On the other side, we are now ushering in a fascinating golden age of the security rodeo. There is astonishing growth in this industry, enjoy unending contracts for Red and Blue alike. It could soon really begin to look like a Gibson novel.

shkkmo 5y ago
The problem is it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies. It's really hard to come up with a set of regulations here that protects users data and doesn't completely disadvantage startups and small businesses.
- ClumsyPilot 5y ago
  We do not regulate how a coffee shop does accounts in the same way we regulate a bank. Many regulations only apply to companies bigger than 50 employees, more than billion of turnover, data on over 1 million people, etc. Or in a spesific market.
- cartoonworld 5y ago
  Well, in this instance I would argue that the current state of affairs also completely disadvantages startups and small businesses. Kaseya has a whole portfolio of services marketed to small, medium and startup business (as well as larger) that their customers bought in order to enable them to leverage this business model in the first place. They've since burned countless providers, torching their relationship with customers, shutting down countless businesses of all sizes all across the planet. What is the cost to them of this? Worst case scenario, they fold and change the sign. The people in charge of not screwing up will be snatched from doom by their network. I would hope they do better next time, but why would that be any more likely than just another over par round of golf? I definitely agree that it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies or to develop some kind of regulatory structure. The alternative to not doing this is accepting this unstable chaos-monkey in perpetuity. If there is no business requirement for effective controls, there wont be any. Kaseya's people can walk and start another tire fire and surely everyone else will sweep up and move on, but these problems are everybody's problems. There is no IT infrastructure that does not require effective controls. If we don't improve this problem, things are gonna get weird.
  - shkkmo 5y ago
    I agree and just because something isn't easy doesn't mean it isn't worth the effort to get right.
alisonkisk 5y ago
> open shop in Anguilla or wherever. That doesn't grant a GDPR exemption. The "shop" still operates in jurisdiction.

shkkmo 5y ago

The problem is it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies. It's really hard to come up with a set of regulations here that protects users data and doesn't completely disadvantage startups and small businesses.

ClumsyPilot 5y ago
We do not regulate how a coffee shop does accounts in the same way we regulate a bank. Many regulations only apply to companies bigger than 50 employees, more than billion of turnover, data on over 1 million people, etc. Or in a spesific market.
cartoonworld 5y ago
Well, in this instance I would argue that the current state of affairs also completely disadvantages startups and small businesses. Kaseya has a whole portfolio of services marketed to small, medium and startup business (as well as larger) that their customers bought in order to enable them to leverage this business model in the first place. They've since burned countless providers, torching their relationship with customers, shutting down countless businesses of all sizes all across the planet. What is the cost to them of this? Worst case scenario, they fold and change the sign. The people in charge of not screwing up will be snatched from doom by their network. I would hope they do better next time, but why would that be any more likely than just another over par round of golf? I definitely agree that it is not easy to asses the security risk of small businesses in a cost effective way for insurance companies or to develop some kind of regulatory structure. The alternative to not doing this is accepting this unstable chaos-monkey in perpetuity. If there is no business requirement for effective controls, there wont be any. Kaseya's people can walk and start another tire fire and surely everyone else will sweep up and move on, but these problems are everybody's problems. There is no IT infrastructure that does not require effective controls. If we don't improve this problem, things are gonna get weird.
- shkkmo 5y ago
  I agree and just because something isn't easy doesn't mean it isn't worth the effort to get right.

alisonkisk 5y ago

> open shop in Anguilla or wherever. That doesn't grant a GDPR exemption. The "shop" still operates in jurisdiction.