4 ms·
> pay their fortinet renewal and check "Security: Done!" without any kind of analysis. there exists objective measure of security, which would be some sort of
by chii 25d ago
> pay their fortinet renewal and check "Security: Done!" without any kind of analysis.
there exists objective measure of security, which would be some sort of hacks/breaches per period. If customers cared about it (and i assume they do), they would choose companies that have less breaches over others with higher counts, normalized on cost differences.
Therefore, if companies didnt actually try to fix their security but instead just checked boxes, they would get breached more often, resulting in customer losses.
The only thing stopping this from actually occurring is the lack of mandatory regulatory reporting of it. So this is where gov't needs to step in and mandate disclosure etc.
- geon 25d agoBreaches don’t happen often enough to be a useful metric. Most smaller companies are never breached, despite having basically zero security.
- IAmBroom 25d agoThe number of breaches would have to be honestly reported for that idea to work. None of the security firms would want to do that; least of all the lowest quartile of them.
- chii 25d ago> would have to be honestly reported for that idea to work. and why does this idea work for accounting audits, but not for security? As long as regulations for companies exist, they would necessarily follow it, and this would lead to reporting of security breaches just like companies would have to report their financials honestly.
- thunderfork 25d agoAccounting is generally both easier to do correctly and easier to verify than security practices, unfortunately
- bloppe 25d agoWe're talking about reporting breaches, not giving yourself some sort of abstract security score
- solatic 25d agoAnd how do you know if you have been breached if you (negligently, in my opinion) have no audit logging, multiple principals sharing the same account, and no anomaly tracking? Does a breach only happen if the attacker brags openly about it? The difference with accounting is that, relatively speaking and certainly within this context, few businesses are cash businesses. Your bank is keeping at least a basic audit log of money coming in and out of the corporate bank account. Your payment processor is keeping at least a basic audit log of who paid you and how much. You won't make your auditors happy if they're the only documents you have, but they're at least something to be handed over in an audit that pretty much every software business will have. Cybersecurity? By default, nothing is collected.
- chii 24d agoforensic accounting and audits also require a paper trail. So if you have no logging and such, you will have already failed regulatory reporting standards - just like you would fail an accounting audit if you have no paper trail of where your money went!