4 ms·

Resource constrained organizations will almost always choose to invest their resources to get MORE resources, not protect against the chance that something bad

Resource constrained organizations will almost always choose to invest their resources to get MORE resources, not protect against the chance that something bad will happen. This is a good point but it points to something some might not like. Resource constrained warehouses might on skimp on covering the risk of fire, resource constrained restaurants might skimp on sanitation, Resource constrained power companies (PG&E) might skimp on line maintenance and let whole towns burn to the ground (Paradise, 80+ people, Berry Creek 30+ etc) and so-forth (up to every company being too "resource constrained" to pay to stop global warming). In cases of this sort, you have companies risking both their capital and the life and limb of average people. We really have companies following this resource constrained logic and horrible things have and are happening. Economists describe this dynamic in terms of "externalities" and letting it run rampant pretty literally has in world on fire (and drowned under water, etc).

tomc1985 5y ago
You bring up a very good point, and personally I attribute this to the tyranny of shareholder primacy. At least here in the states, nothing is going to change until there is an alternative that places shareholders at a level that is at most equal to other considerations, and more preferably below more important business considerations.
- Godel_unicode 5y ago
  That's not how anything works. The shareholders are the ones asking the company to do a good job with the important business decisions so that the company will do well and the stock will go up. How else would it work...?
  - tomc1985 5y ago
    As some other comments point out, security hardening doesn't directly raise company value. It's hard to justify in the short-term. Attitudes about it are much better now than they have ever been, but there are still a lot of folks out there that don't prioritize it.
    - Godel_unicode 5y ago
      This argument is super lazy. Businesses do tons of things which don't raise short-term value. R&D, buying insurance, hiring junior people, laying out money for reserved instances with AWS. Guess what all of these have in common? The exact thing that security has; eliminating long-term risk. Don't blame the stock holders because your arguments didn't persuade management...
  - yccs27 5y ago
    More like, the shareholders are asking the company to do whatever it takes to turn the biggest possible profit. That might mean solid business decisions, or unscrupulous externalization of costs.
- an_opabinia 5y ago
  There are lots of human endeavors that have zero shareholders, involve computers, and the people doing them think about security exactly 0 minutes out of the day and everyone thrives. This is to say that the opinion about how it’s the bottom line blah blah blah is probably totally wrong, and maybe the security blowhards are just talking about shit that is irrelevant like 99% of the time.
  - blooalien 5y ago
    And then you have huge corporations with zillions of dollars passing through their systems, employing hundreds or thousands of people, and storing terabytes of mission-critical data, who treat the people who try to help them make wise IT decisions like mindless code-monkeys who don't know anything, despite having been ostensibly hired for their expertise on the topic.
    - silexia 5y ago
      Stop blaming the victims. If every corporation had to enforce their own physical security with a private army to prevent theft or killing of their employees, then no business could be a going concern. We have a social contract where businesses just need to put forth some minimum effort (door locks, alarm) and police and the military do the rest. We need to enforce this social contract online and against global criminals now. If the criminals are in a state that harbors them, use 10x retaliation to that state to give them an incentive to fix the problem. Dictators don't respect anything but force.
      - blooalien 5y ago
        Yeah, I've come to realize we don't have any "social contracts" on this planet. We have a planetary cancer called "humanity" that barely manages to cooperate even in their common desire for destruction of everything good in the universe.
- scruffyherder 5y ago
  And yet we mitigated y2k. All with publicly traded companies. The reward was simply being open for business on 1/1/2001 without slipping a beat. Sometimes I think as an industry we hyped too much and over delivered giving the impression that it was no big deal.
  - ziml77 5y ago
    The difference is that we knew that the Y2K bug was coming. It was a given that we were going to end up reaching 1/1/2000. Here, it's not a given that backups will ever need to be touched. Spending a lot of money to fix something that is known will happen is easy to justify. If you don't do it, you will end up losing significant amounts of money. For something that isn't guaranteed to happen, it's harder to justify putting a lot of money into it. What is the value of doing thorough testing of backups if they're never actually accessed? One could argue that it's purely a waste of money.
    - hutzlibu 5y ago
      "One could argue that it's purely a waste of money. " A counterargument would be just any of the frequent news articles about company X having to pay Y millions or lost such and such money.
  - mypalmike 5y ago
    * 1/1/2000
    - bluGill 5y ago
      Actually 3 dates, that was one. 2000 was a leap year and lots of systems got that wrong. 9/9/1999 was sometimes used as a can't happen date as well.
pjerem 5y ago
Your point of mixing security risks with fire, sanity or environmental risks is interesting. Those externalities are historically managed by regulation and laws so they are equal rules for every company : you are not theoretically in competition with companies that don’t protect themselves against fire because it’s mandatory to do so (in many countries). Maybe we should start to make companies responsible for not somehow mitigating the risk of being attacked. It makes even more sense when customer privacy is concerned. I know GDPR started in that direction though.
- Aerroon 5y ago
  >you are not theoretically in competition with companies that don’t protect themselves against fire because it’s mandatory to do so (in many countries). But in practice you can be. Companies can get away with not following regulations for a long time. This isn't all too uncommon in the restaurant business. Regulations need to be cheap and easy to follow. Otherwise they'll be skirted here and there. Yes, businesses will get in trouble for not following them, but if enforcement isn't on top of most of the violations then you'll just create a system where everyone ends up skirting the rules.
  - pjerem 5y ago
    I do agree with your point. However, I feel like regulations & norms tends to work over time. If security became a mandatory thing, single actors will of course be slow to invest, but the industry by itself will adapt by easing the adaptation to regulation. For example, in fire safety, it’s now harder to build a non fireproof building because nobody will build that since building technics are now fully integrating this issue. Your local web agency may not do a lot more effort to backup its data due to regulation, but you can imagine that its hosting provider would be able to provide a cheap and friendly backup solution thanks to this becoming mandatory. It’s just my thoughts.
    - Aerroon 5y ago
      This is very true! And that's part of what I was going for - if it's cheap enough then people will use them.

tomc1985 5y ago

You bring up a very good point, and personally I attribute this to the tyranny of shareholder primacy. At least here in the states, nothing is going to change until there is an alternative that places shareholders at a level that is at most equal to other considerations, and more preferably below more important business considerations.

Godel_unicode 5y ago
That's not how anything works. The shareholders are the ones asking the company to do a good job with the important business decisions so that the company will do well and the stock will go up. How else would it work...?
- tomc1985 5y ago
  As some other comments point out, security hardening doesn't directly raise company value. It's hard to justify in the short-term. Attitudes about it are much better now than they have ever been, but there are still a lot of folks out there that don't prioritize it.
  - Godel_unicode 5y ago
    This argument is super lazy. Businesses do tons of things which don't raise short-term value. R&D, buying insurance, hiring junior people, laying out money for reserved instances with AWS. Guess what all of these have in common? The exact thing that security has; eliminating long-term risk. Don't blame the stock holders because your arguments didn't persuade management...
- yccs27 5y ago
  More like, the shareholders are asking the company to do whatever it takes to turn the biggest possible profit. That might mean solid business decisions, or unscrupulous externalization of costs.
an_opabinia 5y ago
There are lots of human endeavors that have zero shareholders, involve computers, and the people doing them think about security exactly 0 minutes out of the day and everyone thrives. This is to say that the opinion about how it’s the bottom line blah blah blah is probably totally wrong, and maybe the security blowhards are just talking about shit that is irrelevant like 99% of the time.
- blooalien 5y ago
  And then you have huge corporations with zillions of dollars passing through their systems, employing hundreds or thousands of people, and storing terabytes of mission-critical data, who treat the people who try to help them make wise IT decisions like mindless code-monkeys who don't know anything, despite having been ostensibly hired for their expertise on the topic.
  - silexia 5y ago
    Stop blaming the victims. If every corporation had to enforce their own physical security with a private army to prevent theft or killing of their employees, then no business could be a going concern. We have a social contract where businesses just need to put forth some minimum effort (door locks, alarm) and police and the military do the rest. We need to enforce this social contract online and against global criminals now. If the criminals are in a state that harbors them, use 10x retaliation to that state to give them an incentive to fix the problem. Dictators don't respect anything but force.
    - blooalien 5y ago
      Yeah, I've come to realize we don't have any "social contracts" on this planet. We have a planetary cancer called "humanity" that barely manages to cooperate even in their common desire for destruction of everything good in the universe.
scruffyherder 5y ago
And yet we mitigated y2k. All with publicly traded companies. The reward was simply being open for business on 1/1/2001 without slipping a beat. Sometimes I think as an industry we hyped too much and over delivered giving the impression that it was no big deal.
- ziml77 5y ago
  The difference is that we knew that the Y2K bug was coming. It was a given that we were going to end up reaching 1/1/2000. Here, it's not a given that backups will ever need to be touched. Spending a lot of money to fix something that is known will happen is easy to justify. If you don't do it, you will end up losing significant amounts of money. For something that isn't guaranteed to happen, it's harder to justify putting a lot of money into it. What is the value of doing thorough testing of backups if they're never actually accessed? One could argue that it's purely a waste of money.
  - hutzlibu 5y ago
    "One could argue that it's purely a waste of money. " A counterargument would be just any of the frequent news articles about company X having to pay Y millions or lost such and such money.
- mypalmike 5y ago
  * 1/1/2000
  - bluGill 5y ago
    Actually 3 dates, that was one. 2000 was a leap year and lots of systems got that wrong. 9/9/1999 was sometimes used as a can't happen date as well.

pjerem 5y ago

Your point of mixing security risks with fire, sanity or environmental risks is interesting. Those externalities are historically managed by regulation and laws so they are equal rules for every company : you are not theoretically in competition with companies that don’t protect themselves against fire because it’s mandatory to do so (in many countries). Maybe we should start to make companies responsible for not somehow mitigating the risk of being attacked. It makes even more sense when customer privacy is concerned. I know GDPR started in that direction though.

Aerroon 5y ago
>you are not theoretically in competition with companies that don’t protect themselves against fire because it’s mandatory to do so (in many countries). But in practice you can be. Companies can get away with not following regulations for a long time. This isn't all too uncommon in the restaurant business. Regulations need to be cheap and easy to follow. Otherwise they'll be skirted here and there. Yes, businesses will get in trouble for not following them, but if enforcement isn't on top of most of the violations then you'll just create a system where everyone ends up skirting the rules.
- pjerem 5y ago
  I do agree with your point. However, I feel like regulations & norms tends to work over time. If security became a mandatory thing, single actors will of course be slow to invest, but the industry by itself will adapt by easing the adaptation to regulation. For example, in fire safety, it’s now harder to build a non fireproof building because nobody will build that since building technics are now fully integrating this issue. Your local web agency may not do a lot more effort to backup its data due to regulation, but you can imagine that its hosting provider would be able to provide a cheap and friendly backup solution thanks to this becoming mandatory. It’s just my thoughts.
  - Aerroon 5y ago
    This is very true! And that's part of what I was going for - if it's cheap enough then people will use them.