4 ms·
Bad idea, I can think of tons of problems off the top of my head: Who defines "best security practices"? How nimble could that process be to new technologies, n
by guelo 4y ago
Bad idea, I can think of tons of problems off the top of my head: Who defines "best security practices"? How nimble could that process be to new technologies, new businesses ideas, new threats? Would it be too costly for startups to implement on launch? How could giant complex systems of big tech possibly be audited externally? I could go on.
- tsol 4y agoExactly. Another important question is-- how often will this change? These kinds of regulations can also provide a 'moat' for larger companies by keeping smaller companies out, leading to monopolization.
- reaperducer 4y agoWho defines "best security practices"? Agreed. In my company, "best practices" means "what I want," "what I'm used to," "what the sales guy is selling", or "what my boss wants." There is no such thing as "best practices," and certainly no "best security practices." Such a thing would have to be developed, perhaps by NIST. And even then, it would only exist as a baseline so that middle managers could mark a checkbox off on a list. The only solution I can think of is to make companies financially liable in a way that actually hurts them. One of the reasons that healthcare companies run around in a HIPAA hysteria is that HIPAA violations can actually cause them great financial harm. The same cannot be said for mot of the tech industry.