4 ms·
Good. Make it law in every other country too. You would not believe the amount of duct tape holding systems together; crowd sourcing the inspections would at le
by sillysaurusx 4y ago
Good. Make it law in every other country too. You would not believe the amount of duct tape holding systems together; crowd sourcing the inspections would at least get eyeballs on the problems, even if it caused an uptick in security incidents.
(Former pentester @matasano, though only for a little over a year.)
After witnessing the results of over 50 pentests, you’re dragged to the conclusion that (a) companies usually get pentests because they’re forced to by other companies, and (b) the security incidents that do happen tend not to affect the companies themselves.
By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach.
De-legislating cybersecurity will improve security, almost by definition. As you say, you’re forced to secure your systems. This is probably a net positive, and hopefully the experiment in Belgium will show why.
- pcthrowaway 4y ago> By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. Ashley Madison, and Mt Gox come to mind. I suspect Lastpass will be added to that list soon.
- 16bitvoid 4y agoJust checked: Ashley Madison is still in business and reached their highest (known) peak of users in 2019, about 4 years after the leak.
- anonym29 4y agoThis begs the question: who's more stupid, the business that negligently screwed their customers, or the customers who came back after?
- jstarfish 4y agoThere is an unstated implication that negligence doesn't happen twice. I'd sooner assume the membership count comprises bots and repeat throwaway/voyeur accounts.
- yieldcrv 4y agoit wasn't that customers came back, aspiring women noticed the gap in the market from the data leaks and chose to be sex workers, replacing the sock puppet users with real women. the hack and leak was a blessing in disguise for ashley madison. this is already reported but once you leave the corporate sex worker exclusionary echo chamber it becomes more obvious how efficient that market is, from the supply side it would alter most of your assumptions and make a lot of things more obvious without needing to be “studied”
- tough 4y ago> By (b) I mean “security doesn’t matter,” in the sense that very few companies have ever died from security incidents. The cost is borne by the customers whose data is exposed, not the companies who allowed the breach. Shouldn't the companies be liable for millions of dollars on a sane justice system?