4 ms·

As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Depends on the industry. I'm in healthcare, and our legal department is a

As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected. We get training on it every six months.

stevenicr 2y ago
I'd like to hear more about this training - I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues.. looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.
- ziddoap 2y ago
  Not the person you are replying to, but I work in security and have spent ~5 years of my career helping various companies set up and maintain security awareness programs. There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house security staff, these types of offerings can be quite helpful. For a more grounds-up approach, there are guidelines such as the NIST SP 800-50 "Building a Cybersecurity and Privacy Learning Program" guidance. (https://csrc.nist.gov/pubs/sp/800/50/r1/final https://csrc.nist.gov/pubs/sp/800/50/r1/final) If you have specific questions, I can try to answer them.
  - reaperman 2y ago
    As a technically-minded person, I've found both KnowBe4 and ProofPoint trainings to be very lacking/boring/superficial.
    - ziddoap 2y ago
      While I agree with you, that's why they are a starting point for someone looking to stand up a program, not an end point. And, from my experience, many of the trainings that seem almost offensively easy to me (e.g. "How to read a URL") have been some of the ones that received the most positive feedback from non-technical departments. The real key with security awareness training is ensuring the training is at the appropriate level of complexity for the trainee.
    - transcriptase 2y ago
      One way to relieve the boredom is to count the number of times you see the people in videos typing away on desktops/monitors with no cables plugged into them.
    - datavirtue 2y ago
      KnowBe4 is awesome. It trains everyone to be on the lookout. The penalty for barely screwing up is another boring training session that no one has time for. Very painful. Pain is a great teacher.
    - stevenicr 2y ago
      Very glad to these options and how they can be perceived by people, this should mean there are paths and that if they can be made better / different for different audiences that they may be well received. Appreciate you and @ziddoap offering insight! Looking at starting deck for FTC issues, Hipaa issues, and Google's policies - all for websites and apps specifically very soon and let the videos / webinars / interactive / discussions grow from here.
infogulch 2y ago
So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.
- reaperducer 2y ago
  So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"
  - infogulch 2y ago
    Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.
  - jjmarr 2y ago
    You have to provide your email to sign up for HN, however, it is not publicly visible. If YCombinator had to pay $10,000 for leaking a user email, this site isn't going to exist since it's not their core business and represents a huge liability. It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name. Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure
    - pbhjpbhj 2y ago
      Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers). If the outcome of ignoring data security is to not make any money then companies will actually do something about it. Penalities should push the company to the point of failing.
stackskipton 2y ago
Except Change Healthcare got hacked, lost a ton of records and they are still operating. So those fines must be, could be up to xx,000 per person affected but in actuality, those affected will get Arbys coupon and C Suite will lose a week of yacht time.
- junon 2y ago
  Not even that. You always have insurance for this stuff.
  - rendaw 2y ago
    But then the insurance company has to pay, and they'll work hard to make sure it doesn't happen. This doesn't sound like an explanation to me.
    - junon 2y ago
      You don't really have a choice, you have to have insurance for breaches (HIPAA term, not strictly the typical cybersec term, means any loss of control of information that results in potential of dissemination of PII).
- somehnguy 2y ago
  I didn’t even get an Arby’s coupon. I got a letter telling me they gave away my information with a link to an “identity monitoring” site that looks like the CEOs nephew built in a weekend and just errors out when I sign up.
- ycombinatrix 2y ago
  I'd honestly prefer an Arby's coupon or perhaps a crisp $1 note over "1 year subscription to our credit monitoring service"
pyuser583 2y ago
Yeah I got those trainings when I was merely healthcare adjacent adjacent adjacent.
plagiarist 2y ago
It turns out HIPAA is a pretty good incentive to do the right thing, and the key difference is that there are actual consequences for violating HIPAA. Even better, the consequences are stronger in the event that the company obviously wasn't giving a fuck about security. I wish we had HIPAA for all PII.
- esafak 2y ago
  But it does slow things down. Startups don't want to deal with that stuff. So they'd have to outsource it. I'm not sure how.

stevenicr 2y ago

I'd like to hear more about this training - I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues.. looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.

ziddoap 2y ago
Not the person you are replying to, but I work in security and have spent ~5 years of my career helping various companies set up and maintain security awareness programs. There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house security staff, these types of offerings can be quite helpful. For a more grounds-up approach, there are guidelines such as the NIST SP 800-50 "Building a Cybersecurity and Privacy Learning Program" guidance. (https://csrc.nist.gov/pubs/sp/800/50/r1/final https://csrc.nist.gov/pubs/sp/800/50/r1/final) If you have specific questions, I can try to answer them.
- reaperman 2y ago
  As a technically-minded person, I've found both KnowBe4 and ProofPoint trainings to be very lacking/boring/superficial.
  - ziddoap 2y ago
    While I agree with you, that's why they are a starting point for someone looking to stand up a program, not an end point. And, from my experience, many of the trainings that seem almost offensively easy to me (e.g. "How to read a URL") have been some of the ones that received the most positive feedback from non-technical departments. The real key with security awareness training is ensuring the training is at the appropriate level of complexity for the trainee.
  - transcriptase 2y ago
    One way to relieve the boredom is to count the number of times you see the people in videos typing away on desktops/monitors with no cables plugged into them.
  - datavirtue 2y ago
    KnowBe4 is awesome. It trains everyone to be on the lookout. The penalty for barely screwing up is another boring training session that no one has time for. Very painful. Pain is a great teacher.
  - stevenicr 2y ago
    Very glad to these options and how they can be perceived by people, this should mean there are paths and that if they can be made better / different for different audiences that they may be well received. Appreciate you and @ziddoap offering insight! Looking at starting deck for FTC issues, Hipaa issues, and Google's policies - all for websites and apps specifically very soon and let the videos / webinars / interactive / discussions grow from here.

infogulch 2y ago

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.

reaperducer 2y ago
So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"
- infogulch 2y ago
  Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.
- jjmarr 2y ago
  You have to provide your email to sign up for HN, however, it is not publicly visible. If YCombinator had to pay $10,000 for leaking a user email, this site isn't going to exist since it's not their core business and represents a huge liability. It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name. Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure
  - pbhjpbhj 2y ago
    Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers). If the outcome of ignoring data security is to not make any money then companies will actually do something about it. Penalities should push the company to the point of failing.

stackskipton 2y ago

Except Change Healthcare got hacked, lost a ton of records and they are still operating. So those fines must be, could be up to xx,000 per person affected but in actuality, those affected will get Arbys coupon and C Suite will lose a week of yacht time.

junon 2y ago
Not even that. You always have insurance for this stuff.
- rendaw 2y ago
  But then the insurance company has to pay, and they'll work hard to make sure it doesn't happen. This doesn't sound like an explanation to me.
  - junon 2y ago
    You don't really have a choice, you have to have insurance for breaches (HIPAA term, not strictly the typical cybersec term, means any loss of control of information that results in potential of dissemination of PII).
somehnguy 2y ago
I didn’t even get an Arby’s coupon. I got a letter telling me they gave away my information with a link to an “identity monitoring” site that looks like the CEOs nephew built in a weekend and just errors out when I sign up.
ycombinatrix 2y ago
I'd honestly prefer an Arby's coupon or perhaps a crisp $1 note over "1 year subscription to our credit monitoring service"

pyuser583 2y ago

Yeah I got those trainings when I was merely healthcare adjacent adjacent adjacent.

plagiarist 2y ago

It turns out HIPAA is a pretty good incentive to do the right thing, and the key difference is that there are actual consequences for violating HIPAA. Even better, the consequences are stronger in the event that the company obviously wasn't giving a fuck about security. I wish we had HIPAA for all PII.

esafak 2y ago
But it does slow things down. Startups don't want to deal with that stuff. So they'd have to outsource it. I'm not sure how.