3 ms·

Regulation that requires signoff from multiple individuals is nothing new. The only piece that is unique is the "highly targeted users" callout, but that can b

by slg 5y ago

Regulation that requires signoff from multiple individuals is nothing new. The only piece that is unique is the "highly targeted users" callout, but that can be generalized too. For example, there could be heightened requirements for social media accounts based off their reach. A million followers, subscribers, fans, patrons, or whatever term you use and that account now requires heightened security. But either way, you are getting too bogged down in the specifics of my hypotheticals. Like I said originally I don't have the answer on the perfect solution, but the fact that we didn't use this incident as motivation to have a discussion about potential solutions is disappointing. Can you at least agree with that?

azinman2 5y ago
My issue is with you saying: > legislative changes in order prevent that worse version from happening in the future. I’m not convinced legislation achieve your goal having already seen HIPAA in action in law, the systems behind the scene, and the ways in which compliance works. Is it better than nothing? Sure! Does it actually create truly secure systems? I don’t think so. If liabilities are severe where companies could go under or people go to jail, then I’m still not sure that would be enough to secure systems because you’re always a 0-day away from breach. But if the result is twitter going under or their CSO jailed, all I think that happens is you remove global competitiveness. I agree with you more should be done. But perhaps in different ways. For example, requiring everyone to take basic security classes before you can be a software engineer might help. Creating societal incentives where bug bounties are required, white hats cannot go to jail or be sued, DARPA spends big on defensive security strategies, and stating the US will take cyber attacks the same as physical attacks are ways that I think would produce better outcomes (but would risk war).
staticassertion 5y ago
FWIW, jumping in here, I agree with you that we should be having this conversation. It's just that the conversation is going to be an inherently slow one since it's talking about very sweeping, broad changes. So it happens in little pieces and little changes over time.

by slg 5y ago

azinman2 5y ago

My issue is with you saying: > legislative changes in order prevent that worse version from happening in the future. I’m not convinced legislation achieve your goal having already seen HIPAA in action in law, the systems behind the scene, and the ways in which compliance works. Is it better than nothing? Sure! Does it actually create truly secure systems? I don’t think so. If liabilities are severe where companies could go under or people go to jail, then I’m still not sure that would be enough to secure systems because you’re always a 0-day away from breach. But if the result is twitter going under or their CSO jailed, all I think that happens is you remove global competitiveness. I agree with you more should be done. But perhaps in different ways. For example, requiring everyone to take basic security classes before you can be a software engineer might help. Creating societal incentives where bug bounties are required, white hats cannot go to jail or be sued, DARPA spends big on defensive security strategies, and stating the US will take cyber attacks the same as physical attacks are ways that I think would produce better outcomes (but would risk war).

staticassertion 5y ago

FWIW, jumping in here, I agree with you that we should be having this conversation. It's just that the conversation is going to be an inherently slow one since it's talking about very sweeping, broad changes. So it happens in little pieces and little changes over time.