3 ms·

This "where do we draw the line" talk is always so exhausting to he for me. The suggested answer inevitably boils down to "let's not have a line at all", instea

This "where do we draw the line" talk is always so exhausting to he for me. The suggested answer inevitably boils down to "let's not have a line at all", instead of trying to draw a reasonable line and deciding on a case-by-case basis what is and isn't reasonable. While trying to be reasonable might have unexpected outcomes for either side sometimes, not having a line at all always unfairly skews the damages to one side.

AnthonyMouse 2y ago
Suppose you've designed your systems according to sound and efficient practices. You have offsite and offline backups, monitoring systems, zero trust architecture, well-documented systems that can be rebuilt from scratch using automated processes, etc. If some compromise happens the scope is extremely limited and well-defined and the mitigation is swift and inexpensive. Also, there probably wouldn't have been one to begin with. Now suppose you're a disaster. There is a combination lock on the front door with the combination already punched into it and if anyone walks through the door they have full access to everything from your employees' bank routing numbers to the VPN credentials providing access to your suppliers' networks, with no logs of any kind. If someone gets inside and you want to know what they did you'll have to shutter the company for a year while a team of full-time engineers and forensic accountants tries to reconcile the numbers in each set of systems with the others and resolve any inconsistencies through some combination of vibes and whimsy. Your costs in the second case are going to be dramatically higher, but that isn't a consequence of anything the person who walked through the door did. That's something you did to yourself. Failure to mitigate is a thing. The damages in the first case would be zero or close to zero, which implies the damages in the second case should be the same because the party claiming the damages is the one responsible for the difference. Moreover, this is the incentive we want, because we want organizations to minimize damages and suffer consequences if they don't.

AnthonyMouse 2y ago

Suppose you've designed your systems according to sound and efficient practices. You have offsite and offline backups, monitoring systems, zero trust architecture, well-documented systems that can be rebuilt from scratch using automated processes, etc. If some compromise happens the scope is extremely limited and well-defined and the mitigation is swift and inexpensive. Also, there probably wouldn't have been one to begin with. Now suppose you're a disaster. There is a combination lock on the front door with the combination already punched into it and if anyone walks through the door they have full access to everything from your employees' bank routing numbers to the VPN credentials providing access to your suppliers' networks, with no logs of any kind. If someone gets inside and you want to know what they did you'll have to shutter the company for a year while a team of full-time engineers and forensic accountants tries to reconcile the numbers in each set of systems with the others and resolve any inconsistencies through some combination of vibes and whimsy. Your costs in the second case are going to be dramatically higher, but that isn't a consequence of anything the person who walked through the door did. That's something you did to yourself. Failure to mitigate is a thing. The damages in the first case would be zero or close to zero, which implies the damages in the second case should be the same because the party claiming the damages is the one responsible for the difference. Moreover, this is the incentive we want, because we want organizations to minimize damages and suffer consequences if they don't.