3 ms·

Most cyber breaches would stop if governments levied fines of a level commensurate with the breaches. For instance, if companies were fined on a pro rata basis

Most cyber breaches would stop if governments levied fines of a level commensurate with the breaches. For instance, if companies were fined on a pro rata basis that equaled or exceeded profit from storing people's data then those companies that couldn't guarantee security wouldn't take the risk and get out of the business. If there are objections to this fines model then there are others. It seems to me the real problem with cyber security is lobbying pressure from corporate interests on politicians, hence no appropriate laws with enough deterrent value in place.

Beached 3y ago
while I agree that fines for breaches should be more frequent and severe, it's impossible to guarantee security
- orhmeh09 3y ago
  It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Someone needs to be accountable.
  - bob-09 3y ago
    In Davenport, Iowa, the fine for a building collapse is $300. https://cbs2iowa.com/news/local/owner-of-davenport-apartment-complex-that-collapsed-facing-300-fine https://cbs2iowa.com/news/local/owner-of-davenport-apartment...
  - jstarfish 3y ago
    > It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Breaches aren't random accidents, they're deliberate acts of espionage.
- hilbert42 3y ago
  "...it's impossible to guarantee security" I agree, but with the right laws in place that have appropriate sanctions that cover both corporations and their employees then we'd see a dramatic reduction. A solution won't be found by just prosecuting corporations alone, for as we've seen with Google, Facebook etc. they've billions at their disposal so fines are just part of the cost of doing business. Their employees also have to be held accountable at the risk of being jailed. Few employees would risk jail just to support corporate profits. Carefully-worded law could make this work without being too punitive. Security breaches will still happen and some unavoidable given the state of art etc. In those circumstances employees who could demonstrate their bona fides etc. would be immune from prosecution. It's a matter of political will, cyber security can be greatly improved if the citizenry wants it badly enough.
_8j50 3y ago
That is such a presumtive baseless statement, what data do you have to back that up? What would fines do? People don't use azure ad because it's optional, it's how most companies these days authenticate users instead of onprem ad which has its own suite of issues. "Most crime wouldn't happen if home owners stopped storing valuables in their homes" yeah right. This is not a result if MS being negligent. You're victim blaming for karma points without even knowing how exactly the vuln works or was exploited.
- vinyl7 3y ago
  Except using azure ad is storing your valuables in someone else's house
  - _8j50 3y ago
    No, using azuread is storing your valuables in someone else's safety deposit box! The service exists not just for convenience because it is more secure than azure ad. 90%+ ransomwared orgs in my estimate are vicitims of onprem AD abuse!
- hilbert42 3y ago
  "without even knowing how exactly the vuln works or was exploited." If you're offering a service you damn-well ought to know and fix it or it's not fit for purpose. QED. Read my caveat in respect of the above in my other post—re state of the art, employees bona fides etc. There is no logical difference between the rules for cyber security and any other industry. For instance, the Boeing 737 Max fuck-up was because of corporate greed and negligence. For some reason the software industry seems to assume a God-given right to be exempted. It's about time that changed. (If the software industry wants to be considered an engineering profession and treated as such then it has to obey standards as set by law and regulation like every other engineering profession on the planet.)
  - _8j50 3y ago
    > There is no logical difference between the rules for cyber security and any other industry That's the problem with the way tech people who don't get infosec think. There is a huge difference! The entire purpose of cybersecurity is malicious human beings not bugs in software! To use your analogy this attack would be how that malaysian plane was shot down by a russian missile as opposed a malfunction in the 737. A chinese military/intel unit attacked microsoft, the real world equivalent would make you ask why the US military did not defend MS not why MS couldn't defend against a nation state actor that next to the US is the most resourced on the planet! > It's about time that changed It's about time you and others put the blame on threat actors and hold your military/intel apparatus accountable. Bugs happen, it is only MS's fault if they failed to follow best practices in securing their infra and code. No matter how hard you try or what process you use, things made by fallinle humans have a vulnerability waiting to be discovered.

Beached 3y ago

while I agree that fines for breaches should be more frequent and severe, it's impossible to guarantee security

orhmeh09 3y ago
It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Someone needs to be accountable.
- bob-09 3y ago
  In Davenport, Iowa, the fine for a building collapse is $300. https://cbs2iowa.com/news/local/owner-of-davenport-apartment-complex-that-collapsed-facing-300-fine https://cbs2iowa.com/news/local/owner-of-davenport-apartment...
- jstarfish 3y ago
  > It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Breaches aren't random accidents, they're deliberate acts of espionage.
hilbert42 3y ago
"...it's impossible to guarantee security" I agree, but with the right laws in place that have appropriate sanctions that cover both corporations and their employees then we'd see a dramatic reduction. A solution won't be found by just prosecuting corporations alone, for as we've seen with Google, Facebook etc. they've billions at their disposal so fines are just part of the cost of doing business. Their employees also have to be held accountable at the risk of being jailed. Few employees would risk jail just to support corporate profits. Carefully-worded law could make this work without being too punitive. Security breaches will still happen and some unavoidable given the state of art etc. In those circumstances employees who could demonstrate their bona fides etc. would be immune from prosecution. It's a matter of political will, cyber security can be greatly improved if the citizenry wants it badly enough.

_8j50 3y ago

That is such a presumtive baseless statement, what data do you have to back that up? What would fines do? People don't use azure ad because it's optional, it's how most companies these days authenticate users instead of onprem ad which has its own suite of issues. "Most crime wouldn't happen if home owners stopped storing valuables in their homes" yeah right. This is not a result if MS being negligent. You're victim blaming for karma points without even knowing how exactly the vuln works or was exploited.

vinyl7 3y ago
Except using azure ad is storing your valuables in someone else's house
- _8j50 3y ago
  No, using azuread is storing your valuables in someone else's safety deposit box! The service exists not just for convenience because it is more secure than azure ad. 90%+ ransomwared orgs in my estimate are vicitims of onprem AD abuse!
hilbert42 3y ago
"without even knowing how exactly the vuln works or was exploited." If you're offering a service you damn-well ought to know and fix it or it's not fit for purpose. QED. Read my caveat in respect of the above in my other post—re state of the art, employees bona fides etc. There is no logical difference between the rules for cyber security and any other industry. For instance, the Boeing 737 Max fuck-up was because of corporate greed and negligence. For some reason the software industry seems to assume a God-given right to be exempted. It's about time that changed. (If the software industry wants to be considered an engineering profession and treated as such then it has to obey standards as set by law and regulation like every other engineering profession on the planet.)
- _8j50 3y ago
  > There is no logical difference between the rules for cyber security and any other industry That's the problem with the way tech people who don't get infosec think. There is a huge difference! The entire purpose of cybersecurity is malicious human beings not bugs in software! To use your analogy this attack would be how that malaysian plane was shot down by a russian missile as opposed a malfunction in the 737. A chinese military/intel unit attacked microsoft, the real world equivalent would make you ask why the US military did not defend MS not why MS couldn't defend against a nation state actor that next to the US is the most resourced on the planet! > It's about time that changed It's about time you and others put the blame on threat actors and hold your military/intel apparatus accountable. Bugs happen, it is only MS's fault if they failed to follow best practices in securing their infra and code. No matter how hard you try or what process you use, things made by fallinle humans have a vulnerability waiting to be discovered.