3 ms·

Solution: Statutory damages for companies who release software with grossly negligent or malicious disregard for best security practices. This form of civil li

Solution: Statutory damages for companies who release software with grossly negligent or malicious disregard for best security practices. This form of civil liability has given us safer cars, home products, machinery, and professional services. Its most often preemptively enforced, not by our court system, but by insurance carriers who insure against the liability.

avg_dev 4y ago
I believe this is a good idea. I don't know a whole lot about law-making, but I know that a lot of ransomware cases could have been prevented by enforcing updates to various packages and operating systems. Please note that I am not claiming that updates are a silver bullet. I am sure if someone managed to obtain credentials that allowed them to release an update for MS Windows, say, and that update installed a keylogger, it would be bad news. But regular updates at the source code dependency, OS, firmware, networking hardware, device layers, mandatory code review, hardware FIDO/U2F tokens, training on best practices for handling data and for writing and reviewing secure code, use of modern encryption algorithms, encryption of sensitive data at rest, requirements to not store PII without a proven need, requirements to change default passwords (or even better yet - laws mandating non-default passwords at ship time), ongoing anti-phishing training, and the like will all help us stay safer. There are bad actors out there. We all make mistakes. Our industry is maturing at an altogether unacceptably slow rate, IMO - a lot of these techniques are well known in the industry, but they cost money and time to implement, and nobody seems to want to expend that effort until it's too damn late. I am not a security expert. Just a developer who tries my best to pay attention.
pattisapu 4y ago
Makes sense. Reallocate the cost to the cheapest cost avoider.
- howmayiannoyyou 4y ago
  No. When there is a claim the insurance company will look for every reason not to cover and stick the insured with the defense and judgement bills. If the insured fails to meet the carrier's requirements they are screwed.
ffritz 4y ago
You are in essence looking for GDPR. It calls for huge fines in case of violations and thus should ideally enforce strong security standards.
sudden_dystopia 4y ago
Just to clarify, individual insurance companies do not have this sort of power. But collectively, as a lobbying group, they definitely do.
- howmayiannoyyou 4y ago
  Incorrect. Individual insurance companies make do underwriting screenings and audits of clients who present certain types of risks. They can deny coverage or deny claims based on the results. On this topic (and several others) I'm something of an expert.
  - elliekelly 4y ago
    I feel like the extent of insurance company “audits” tends to be overstated. Most of the time they want executive attestations that X, Y, and Z are happening. Whether and to what extent X, Y, and Z actually are happening isn’t something the insurance company is likely to investigate unless and until a claim is submitted under the policy. The insurance company doesn’t necessarily care that X, Y, and Z happen they care about mitigating risk. Specifically, their risk of paying out on the policy.
guelo 4y ago
Bad idea, I can think of tons of problems off the top of my head: Who defines "best security practices"? How nimble could that process be to new technologies, new businesses ideas, new threats? Would it be too costly for startups to implement on launch? How could giant complex systems of big tech possibly be audited externally? I could go on.
- tsol 4y ago
  Exactly. Another important question is-- how often will this change? These kinds of regulations can also provide a 'moat' for larger companies by keeping smaller companies out, leading to monopolization.
- reaperducer 4y ago
  Who defines "best security practices"? Agreed. In my company, "best practices" means "what I want," "what I'm used to," "what the sales guy is selling", or "what my boss wants." There is no such thing as "best practices," and certainly no "best security practices." Such a thing would have to be developed, perhaps by NIST. And even then, it would only exist as a baseline so that middle managers could mark a checkbox off on a list. The only solution I can think of is to make companies financially liable in a way that actually hurts them. One of the reasons that healthcare companies run around in a HIPAA hysteria is that HIPAA violations can actually cause them great financial harm. The same cannot be said for mot of the tech industry.
wpietri 4y ago
I think the challenge here is figuring out how regulators and insurers can tell the difference between best practices and things like security theater or former best practices that are now obsolete but are written into regulations or standards. Right now there are only ~250 car models available in the US. Each one gets incredible amounts of attention from all sorts of people, both before and after launch. And cars are pretty stable technology. But there's a ton of software out there: 1.8 million entries in Apple's App Store alone. And our tools and technologies are still evolving at a rapid clip. Having to explain each new library to an insurance company functionary sounds like a major brake on innovation to me.
- avg_dev 4y ago
  Maybe a brake on innovation is a good thing. Social understanding and effective legislation on technological advances lags adoption by quite a long period.
  - wpietri 4y ago
    Possibly, but I think higher security standards may not create the kinds of lag you're looking for there. Adam Neumann and Travis Kalanik are not going to give two shits about IT standards, and even if they did I doubt it would slow down their innovation in business models, ways of dealing with customers, and dealings with government.
- hbrn 4y ago
  A good example is the password rotation policy. It is still enforced by some of the standards (PCI DSS comes to mind), despite existing research that shows it worsens your security.
phillipcarter 4y ago
In general I agree, although the scale of software would mean there has to be some pretty significant flex in this sort of thing. The Twitter/Facebook/etc. of the world can afford having civil liability hang over their heads. But we don't want to live in a world where this kind of thing destroys the incredible software innovation our field has today, mostly from startups and small companies that eventually grow to the size of a Twitter. I feel similarly about the Section 230 issue - past a certain size, orgs are large enough to actually be able to be held to account on matters of speech on the platform - but defining that line is challenging and potentially very destructive.
deleted 4y ago
[deleted]
dylan604 4y ago
how do you prove negligence vs incompetence?

avg_dev 4y ago

I believe this is a good idea. I don't know a whole lot about law-making, but I know that a lot of ransomware cases could have been prevented by enforcing updates to various packages and operating systems. Please note that I am not claiming that updates are a silver bullet. I am sure if someone managed to obtain credentials that allowed them to release an update for MS Windows, say, and that update installed a keylogger, it would be bad news. But regular updates at the source code dependency, OS, firmware, networking hardware, device layers, mandatory code review, hardware FIDO/U2F tokens, training on best practices for handling data and for writing and reviewing secure code, use of modern encryption algorithms, encryption of sensitive data at rest, requirements to not store PII without a proven need, requirements to change default passwords (or even better yet - laws mandating non-default passwords at ship time), ongoing anti-phishing training, and the like will all help us stay safer. There are bad actors out there. We all make mistakes. Our industry is maturing at an altogether unacceptably slow rate, IMO - a lot of these techniques are well known in the industry, but they cost money and time to implement, and nobody seems to want to expend that effort until it's too damn late. I am not a security expert. Just a developer who tries my best to pay attention.

pattisapu 4y ago

Makes sense. Reallocate the cost to the cheapest cost avoider.

howmayiannoyyou 4y ago
No. When there is a claim the insurance company will look for every reason not to cover and stick the insured with the defense and judgement bills. If the insured fails to meet the carrier's requirements they are screwed.

ffritz 4y ago

You are in essence looking for GDPR. It calls for huge fines in case of violations and thus should ideally enforce strong security standards.

sudden_dystopia 4y ago

Just to clarify, individual insurance companies do not have this sort of power. But collectively, as a lobbying group, they definitely do.

howmayiannoyyou 4y ago
Incorrect. Individual insurance companies make do underwriting screenings and audits of clients who present certain types of risks. They can deny coverage or deny claims based on the results. On this topic (and several others) I'm something of an expert.
- elliekelly 4y ago
  I feel like the extent of insurance company “audits” tends to be overstated. Most of the time they want executive attestations that X, Y, and Z are happening. Whether and to what extent X, Y, and Z actually are happening isn’t something the insurance company is likely to investigate unless and until a claim is submitted under the policy. The insurance company doesn’t necessarily care that X, Y, and Z happen they care about mitigating risk. Specifically, their risk of paying out on the policy.

guelo 4y ago

Bad idea, I can think of tons of problems off the top of my head: Who defines "best security practices"? How nimble could that process be to new technologies, new businesses ideas, new threats? Would it be too costly for startups to implement on launch? How could giant complex systems of big tech possibly be audited externally? I could go on.

tsol 4y ago
Exactly. Another important question is-- how often will this change? These kinds of regulations can also provide a 'moat' for larger companies by keeping smaller companies out, leading to monopolization.
reaperducer 4y ago
Who defines "best security practices"? Agreed. In my company, "best practices" means "what I want," "what I'm used to," "what the sales guy is selling", or "what my boss wants." There is no such thing as "best practices," and certainly no "best security practices." Such a thing would have to be developed, perhaps by NIST. And even then, it would only exist as a baseline so that middle managers could mark a checkbox off on a list. The only solution I can think of is to make companies financially liable in a way that actually hurts them. One of the reasons that healthcare companies run around in a HIPAA hysteria is that HIPAA violations can actually cause them great financial harm. The same cannot be said for mot of the tech industry.

wpietri 4y ago

I think the challenge here is figuring out how regulators and insurers can tell the difference between best practices and things like security theater or former best practices that are now obsolete but are written into regulations or standards. Right now there are only ~250 car models available in the US. Each one gets incredible amounts of attention from all sorts of people, both before and after launch. And cars are pretty stable technology. But there's a ton of software out there: 1.8 million entries in Apple's App Store alone. And our tools and technologies are still evolving at a rapid clip. Having to explain each new library to an insurance company functionary sounds like a major brake on innovation to me.

avg_dev 4y ago
Maybe a brake on innovation is a good thing. Social understanding and effective legislation on technological advances lags adoption by quite a long period.
- wpietri 4y ago
  Possibly, but I think higher security standards may not create the kinds of lag you're looking for there. Adam Neumann and Travis Kalanik are not going to give two shits about IT standards, and even if they did I doubt it would slow down their innovation in business models, ways of dealing with customers, and dealings with government.
hbrn 4y ago
A good example is the password rotation policy. It is still enforced by some of the standards (PCI DSS comes to mind), despite existing research that shows it worsens your security.

phillipcarter 4y ago

In general I agree, although the scale of software would mean there has to be some pretty significant flex in this sort of thing. The Twitter/Facebook/etc. of the world can afford having civil liability hang over their heads. But we don't want to live in a world where this kind of thing destroys the incredible software innovation our field has today, mostly from startups and small companies that eventually grow to the size of a Twitter. I feel similarly about the Section 230 issue - past a certain size, orgs are large enough to actually be able to be held to account on matters of speech on the platform - but defining that line is challenging and potentially very destructive.

deleted 4y ago

[deleted]

dylan604 4y ago

how do you prove negligence vs incompetence?