5 ms·

Likely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason

Likely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason security is so bad everywhere is that nobody gets fired when there's a breach. It's just blamed on the hackers and everyone just goes on with life singing "We take security very seriously--this happened because of someone else!"

chii 1y ago
> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).
- ryandrake 1y ago
  Or, the entity being damaged is not the decision maker and has no power to hold the decision maker responsible.
- josephg 1y ago
  End user license agreements are a huge part of the problem. Ideally users could sue if our data is leaked - and the threat of being sued would put pressure on companies to take security more seriously. Ie, it would become a business concern. Instead we're constantly asked to sign one-sided contracts ("EULAs") which forbid us from suing. If a company's incompetence results in my data being leaked on the internet, there's no consequences. And not a thing any of us can do about it.
  - astrange 1y ago
    There is in at least California, the EU, and China. A lot of clauses in EULAs aren't actually legal.
    - devjab 1y ago
      On the other hand you can't sue a company for losing your data in many EU companies. You can report them to whatever data protection agency your country has, and after an investigation they can fine, and/or, in more serious cases turn the matter over to the police for a criminal investigation. The disadvantage of this is that the local data protection agencies haven't been handing out very big fines. Sometimes that's due to company law. In my country you'd fine the owning company, which in many cases will be a holding company. Since fine sizes are linked to revenue and a holding company typically has no revenue, this means fines are often ridicilously small.
- lmm 1y ago
  Or the damage is diffuse whereas the costs of preventing the breach would be concentrated. Or the connection between the damage and the breach is difficult to prove.
- protocolture 1y ago
  >this must mean the consequences of such a breach has either not produced any visible damage Yeah lets say you were carrying unencrypted frames for Bills Burger Hut. The largest extent of the damage might be sniffing some smtp credentials or something. Bill sends some spam messages, never figures out how it was done but their IP reputation is always in the toilet. Lets then say instead of Bills Burger Hut, you are carrying traffic for critical mineral and food industries. The attacker isnt a scammer, but a hostile nation state. Customer never realises, but theres a large, long term financial cost because (TOTALLY NOT CHINA) is sharing this data with competitors of yours overseas, or preparing to drop your pants in a huge way for foreign policy reasons. No one gets fired until after the worst case long term damage, and even then probably not. In fact, the likely outcome is that the burden gets moved to the customer for L2 encryption and the cowboy never changes.
- ozim 1y ago
  If you fire people for stuff they didn’t maliciously introduced you will end up with no people to work with. Imagine jailing doctors for every patient that died you would be out of doctors quite soon.
  - necovek 1y ago
    The legal system already has sufficient cop-out: for anything that you should have been aware of, or would have been informed about. Eg. doctors do get sued and fired for malpractice, if they did something no other skilled doctor would reasonably do ("let's just use the instruments from the previous surgery").
    - sayamqazi 1y ago
      Here are a bunch more things to make you even more scared. - Oops! mistakenly left some instrument inside and sewed up the patient - Junior begging to do certain step of the surgery while the anesthesiologist asking them to just get a move on. - Administered a drug to a newborn baby which was supposed to be given to the mother. (My sister's colleague did this with no consequences)
  - nkrisc 1y ago
    If the doctor is criminally negligent they could be jailed.
    - ozim 1y ago
      That's kind of obvious, I didn't think it has to be spelled out.
      - nkrisc 1y ago
        My point is that something doesn’t have to be malicious to be criminally negligent, if the law says so. I’m suggesting that some of the security breaches we’ve seen ought to have been criminally negligent. Perhaps they weren’t under existing law, but I think they ought to be.
devjab 1y ago
Who do you imagine will get fired? The CISO who's been recommending various security imporvements and been trying to get them implemented, but been unable to do so due to a lack of C level interest in IT. Or the C level's who lack interest in IT security until it bites them in the investor? At least here in the EU we're moving toward personal responsibility for C level's who don't take IT and OT security serious in critical sectors, but in my anecdotal experience that is the first time anything regarding security has actually made decision makers take it serious. A lot of it is still just bureaucracy though. We have a DORA and NIS2 compliant piece of OT that is technically completely insecure but is compliant because we've written a detailed plan on how to make it secure.
- gremlinunderway 1y ago
  Who currently gets fired due to engineering malpractice? It would be the same thing if there was actual certifications and engineering sign-offs in cybersecurity or other critical areas of development. I wont pretend that accountability in the physical engineering world is all smiles and rainbows but at least there are actual laws dictating responsibilities, certification and other real consequences for civil engineers. When a Professional Engineer in Canada signs-off (seal) on work they are legally assuming responsibility which means the practitioner could be held accountable in the event of professional misconduct or incompetence regarding the engineering work. There is no reason but corporate greed and corruption why there isn't similar legislation in North America for cybersecurity or software engineering where you have professional bodies certify people to be legally obligated to sign-off on work (and refuse work that isn't up to standards). But this would require introducing actual legislation which god-forbid how could we do such a thing to the poor market! It would stifle their innovation at leaking everyone's data. There's no reason we couldn't extend the same existing system of licensure [1] that professional engineers require. Sure maybe its overkill for someone stringing together a python app, but if you're engineering the handling of any actual personal information then this work ought to be overseen by qualified, licensed and accountable professionals who are backed by actual laws. [1]https://en.wikipedia.org/w/index.php?title=Regulation_and_licensure_in_engineering https://en.wikipedia.org/w/index.php?title=Regulation_and_li...
notmyjob 1y ago
That and h1b abuse.

chii 1y ago

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

ryandrake 1y ago
Or, the entity being damaged is not the decision maker and has no power to hold the decision maker responsible.
josephg 1y ago
End user license agreements are a huge part of the problem. Ideally users could sue if our data is leaked - and the threat of being sued would put pressure on companies to take security more seriously. Ie, it would become a business concern. Instead we're constantly asked to sign one-sided contracts ("EULAs") which forbid us from suing. If a company's incompetence results in my data being leaked on the internet, there's no consequences. And not a thing any of us can do about it.
- astrange 1y ago
  There is in at least California, the EU, and China. A lot of clauses in EULAs aren't actually legal.
  - devjab 1y ago
    On the other hand you can't sue a company for losing your data in many EU companies. You can report them to whatever data protection agency your country has, and after an investigation they can fine, and/or, in more serious cases turn the matter over to the police for a criminal investigation. The disadvantage of this is that the local data protection agencies haven't been handing out very big fines. Sometimes that's due to company law. In my country you'd fine the owning company, which in many cases will be a holding company. Since fine sizes are linked to revenue and a holding company typically has no revenue, this means fines are often ridicilously small.
lmm 1y ago
Or the damage is diffuse whereas the costs of preventing the breach would be concentrated. Or the connection between the damage and the breach is difficult to prove.
protocolture 1y ago
>this must mean the consequences of such a breach has either not produced any visible damage Yeah lets say you were carrying unencrypted frames for Bills Burger Hut. The largest extent of the damage might be sniffing some smtp credentials or something. Bill sends some spam messages, never figures out how it was done but their IP reputation is always in the toilet. Lets then say instead of Bills Burger Hut, you are carrying traffic for critical mineral and food industries. The attacker isnt a scammer, but a hostile nation state. Customer never realises, but theres a large, long term financial cost because (TOTALLY NOT CHINA) is sharing this data with competitors of yours overseas, or preparing to drop your pants in a huge way for foreign policy reasons. No one gets fired until after the worst case long term damage, and even then probably not. In fact, the likely outcome is that the burden gets moved to the customer for L2 encryption and the cowboy never changes.
ozim 1y ago
If you fire people for stuff they didn’t maliciously introduced you will end up with no people to work with. Imagine jailing doctors for every patient that died you would be out of doctors quite soon.
- necovek 1y ago
  The legal system already has sufficient cop-out: for anything that you should have been aware of, or would have been informed about. Eg. doctors do get sued and fired for malpractice, if they did something no other skilled doctor would reasonably do ("let's just use the instruments from the previous surgery").
  - sayamqazi 1y ago
    Here are a bunch more things to make you even more scared. - Oops! mistakenly left some instrument inside and sewed up the patient - Junior begging to do certain step of the surgery while the anesthesiologist asking them to just get a move on. - Administered a drug to a newborn baby which was supposed to be given to the mother. (My sister's colleague did this with no consequences)
- nkrisc 1y ago
  If the doctor is criminally negligent they could be jailed.
  - ozim 1y ago
    That's kind of obvious, I didn't think it has to be spelled out.
    - nkrisc 1y ago
      My point is that something doesn’t have to be malicious to be criminally negligent, if the law says so. I’m suggesting that some of the security breaches we’ve seen ought to have been criminally negligent. Perhaps they weren’t under existing law, but I think they ought to be.

devjab 1y ago

Who do you imagine will get fired? The CISO who's been recommending various security imporvements and been trying to get them implemented, but been unable to do so due to a lack of C level interest in IT. Or the C level's who lack interest in IT security until it bites them in the investor? At least here in the EU we're moving toward personal responsibility for C level's who don't take IT and OT security serious in critical sectors, but in my anecdotal experience that is the first time anything regarding security has actually made decision makers take it serious. A lot of it is still just bureaucracy though. We have a DORA and NIS2 compliant piece of OT that is technically completely insecure but is compliant because we've written a detailed plan on how to make it secure.

gremlinunderway 1y ago
Who currently gets fired due to engineering malpractice? It would be the same thing if there was actual certifications and engineering sign-offs in cybersecurity or other critical areas of development. I wont pretend that accountability in the physical engineering world is all smiles and rainbows but at least there are actual laws dictating responsibilities, certification and other real consequences for civil engineers. When a Professional Engineer in Canada signs-off (seal) on work they are legally assuming responsibility which means the practitioner could be held accountable in the event of professional misconduct or incompetence regarding the engineering work. There is no reason but corporate greed and corruption why there isn't similar legislation in North America for cybersecurity or software engineering where you have professional bodies certify people to be legally obligated to sign-off on work (and refuse work that isn't up to standards). But this would require introducing actual legislation which god-forbid how could we do such a thing to the poor market! It would stifle their innovation at leaking everyone's data. There's no reason we couldn't extend the same existing system of licensure [1] that professional engineers require. Sure maybe its overkill for someone stringing together a python app, but if you're engineering the handling of any actual personal information then this work ought to be overseen by qualified, licensed and accountable professionals who are backed by actual laws. [1]https://en.wikipedia.org/w/index.php?title=Regulation_and_licensure_in_engineering https://en.wikipedia.org/w/index.php?title=Regulation_and_li...

notmyjob 1y ago

That and h1b abuse.