3 ms·
Define adequate security. Maybe I want to adopt post quantum crypto but now the law doesn't allow it? Or u2f not totp but the law doesn't allow it? Law can hol
by collegeburner 4y ago
Define adequate security. Maybe I want to adopt post quantum crypto but now the law doesn't allow it? Or u2f not totp but the law doesn't allow it? Law can hold back security just as much as improve it. Remember how long it took the feds to get off 3DES? Remember all the leaks of personal data (like all military in US or basically everybody in china)? Govts are shit at security.
- closewith 4y agoIn the case of, say, the GDPR, security requirements aren't prescriptive. You can read Article 32 yourself, but it comes down to being able to "ensure a level of security appropriate to the risk". Whether a company has met that standard is decided by data protection authorities and ultimately the courts. Article 32, GPDR: https://gdpr-info.eu/art-32-gdpr/ https://gdpr-info.eu/art-32-gdpr/
- user3939382 4y ago> Define adequate security SOC2, CSF, FedRAMP?
- enobrev 4y ago> It should be unlawful to process sensitive personal data without adequate security > Define adequate security If there is no means of defining "adequate" when it comes to security of sensitive personal data, then companies should not be allowed to amass and process sensitive personal data. If it's not possible for a company like Experian to exist safely, then it probably shouldn't exist at all.