3 ms·
> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. T
by jjav 3y ago
> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won.
They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten.
The only possible solution is to have significant fines for every data item breached.
Ideally I'd ratchet up the fines for each occurrence. First breach should hurt the company financially a bit but not be too disruptive, offering a learning opportunity.
Subsequent breaches the fines go up, by the fifth breach or so the fines would wipe away the company entirely, since they clearly didn't learn.
Anything short of something like this, companies will never care and leak all your data to the wind every year.
- queuebert 3y agoThis would be create an incentive to attack a competing company until you breach it 5x, causing its destruction. Competitors would be attacking each other nonstop. Like 3 check chess, but in Delaware.
- jjav 3y agoI don't have a huge problem with that to be honest. Maybe not fifth breach, but something along those lines. Well-funded attackers and competing nations are already attacking these companies, so adding their competitors to the mix doesn't change a lot.
- josephg 3y agoYep. And if staying in business means keeping your website secure, well, isn’t that the goal? I think part of the problem is that hacker movies make people think hacking is inevitable. Like you can’t actually protect your site and your data from the average punk on roller skates, so why bother? But that’s not true at all. Gmail has - as far as we know - never been breached by anything short of a nation state attacker. And I’m sure a lot of people have tried. You just need to actually care about security and follow best practices (like doing audits / red team and keep up to date with security patches). But most companies only seem interested in properly investing in security if it’s an existential threat.
- droopyEyelids 3y agoIn my fantasy world a company gets nationalized after the nth breach and we have a well-run federal department of IT with competent and engaged staff