5 ms·

Lets be honest here, this is a business risk which is crazy high. As stupid as this is, I care but i can't guarantee it. I might suggest a construct like this

Lets be honest here, this is a business risk which is crazy high. As stupid as this is, I care but i can't guarantee it. I might suggest a construct like this too. What do you think how much it cost to do it perfect?

louthy 9d ago
Perfect isn’t required. The bar is “gross negligence”. Perfect is impossible, but proper compliance procedures, proper process, and a commitment to following industry best practice will always see you on the right side of the negligence bar, even if something slipped through the net. It’s the difference between being a professional and an amateur (or worse, a ‘cowboy’).
- augment_me 9d ago
  Again this is not priced in. Every rational(in terms of revenue) business would rather be a highly profitable "amateur" compared to a barely profitable "professional". There is no capitalist incentive for the latter, and you will lose market share to firms that can undercut you because of their lower costs.
  - louthy 9d ago
    4% of revenue in the EU, 4% of revenue in the UK, and 10% of revenue in Korea should be enough of an incentive to start caring about how you deal with your customer’s privacy and personal data. One assumes the rest of the world won’t be far behind, apart from the the corrupt land of the USA which is going backwards right now.
    - augment_me 9d ago
      So we get to a very easy formula for companies to do in the EU and UK: If (4% of your revenue * risk_of_breach_with_your_security < cost of outsourcing storage to a 3rd party cloud) { Roll your own security solution } Else { Outsource to 3rd party }
      - louthy 9d ago
        Your replies here suggest a level of cynicism that is, well, … , it ain’t pretty. In my experience, putting proper compliance procedures in place, following industry best practice in relation to data management and data security actually leads to a more effective organisation, because it professionalises. It’s the first step out of the ad-hoc phase of a startup and into the real world of creating a business with value. It also means as you scale up the personnel in the organisation, there are proper checks and balances in place. When you come to sell your business, if it has a ton of existential risks attached to it, it will be worth less and may even not be sellable at all. So even from a cynical “all I care about is money” point-of-view, you want a business that is sound and isn’t storage for future law suits or fines. Also, the cost of a fine due to a data breach isn’t the only thing to be concerned about. Gross negligence could lead loss of life, loss of property, loss of earnings, etc. and the buck stops with the executives — don’t think you can’t be completely fucked by the good ol’ law as it stands today. Some businesses are more vulnerable than others, but that’s also why you scale the compliance architecture to the business.
        rpdillon 9d ago
        The person you're replying to is citing the incentives that are created. That's not cynicism, it's analyzing motives to help model outcomes. As for the buck stopping with the executives: can you apply this to a case I've heard of? We have multiple data breaches of companies that scan IDs. We have the Experian breach. We have multiple LastPass breaches. Is there any executive at any of these companies that has been held accountable? I've actually done the legwork on the ones I just mentioned and the answer is there have been no criminal or civil penalties to any individual in an executive role at any of those companies as a result of the data breaches. Maybe I'm missing one?
        louthy 9d ago
        Maybe I wasn’t clear in my message. But the buck stopping with the executives is when ‘the company’ breaks law. Usually because of gross negligence or corporate manslaughter. With my last company, managing medical records, I was always conscious that if we didn’t take our responsibility of managing medical data correctly it could lead to the death of one of my customer’s patients; or some other extreme circumstance that the executives could be held liable for. That was my point about being professional, if you have proper processes in place and audits to prove it, you have protection. And only the most egregious cases would land. It’s good business to protect yourself from a gross negligence or corporate manslaughter claim. It just so happens that it’s good for your customer too. Presumably, the reason you don’t hear much about executives in the dock for these crimes is because most professional organisations put these processes in place. Again, I was just stating that it isn’t just data-breach fines that should encourage executives to professionalise.
    - fc417fc802 9d ago
      It's only an incentive to start caring if it's cheaper than circumventing the law. In other words it won't work unless the aforementioned liability loophole is closed. To rephrase the comment you replied to, if being a cowboy is more profitable (by whatever shady means) then that will generally be preferred by the market. Despite whatever sensibilities you or I might have there is no escaping that simple truth of capitalism.
    - pkaye 9d ago
      I want to see how much be the fine will for this data leak. https://www.dw.com/en/cyberattack-in-berlin-14-million-files-on-the-dark-web/a-79220829 https://www.dw.com/en/cyberattack-in-berlin-14-million-files...
  - josephg 9d ago
    > There is no capitalist incentive for the latter This is literally the point of data breach laws like this. To provide a financial incentive to take this stuff seriously.
- someguynamedq 8d ago
  The bar for not getting hacked is a lot closer to perfect than gross negligence
  - louthy 8d ago
    The bar is: do you have effective compliance in place? And are you audited? (ISO27001 [1] or similar). If you are hacked and you are seen to have not given a shit about compliance, or independent penetration tests, or proper documentation of process, with good internal controls enforcing your processes. Then you’re almost certainly vulnerable to a negligence claim. However, if you have all that in place, and somehow something slipped through the net. And once aware you put in new controls to make sure it doesn’t happen again, then you’re very unlikely to have the book thrown at you. You may still get a fine, but it would be much reduced. It’s not hard to do this. Yes, compliance can be overdone, so you need key stakeholders to make sure it doesn’t turn into jobsworth heaven; but the actual implementation isn’t hard to do, and if done well, will improve the processes within the business. It’s very much like an insurance policy. It has some ongoing cost, but it saves you from the one big cost. [1] https://www.iso.org/standard/27001 https://www.iso.org/standard/27001
deepsun 9d ago
But it does create an incentive to not keep data that a company doesn't really need. And that incentive already works with GDPR for PII. This measure add similar incentive for data breaches.

louthy 9d ago

Perfect isn’t required. The bar is “gross negligence”. Perfect is impossible, but proper compliance procedures, proper process, and a commitment to following industry best practice will always see you on the right side of the negligence bar, even if something slipped through the net. It’s the difference between being a professional and an amateur (or worse, a ‘cowboy’).

augment_me 9d ago
Again this is not priced in. Every rational(in terms of revenue) business would rather be a highly profitable "amateur" compared to a barely profitable "professional". There is no capitalist incentive for the latter, and you will lose market share to firms that can undercut you because of their lower costs.
- louthy 9d ago
  4% of revenue in the EU, 4% of revenue in the UK, and 10% of revenue in Korea should be enough of an incentive to start caring about how you deal with your customer’s privacy and personal data. One assumes the rest of the world won’t be far behind, apart from the the corrupt land of the USA which is going backwards right now.
  - augment_me 9d ago
    So we get to a very easy formula for companies to do in the EU and UK: If (4% of your revenue * risk_of_breach_with_your_security < cost of outsourcing storage to a 3rd party cloud) { Roll your own security solution } Else { Outsource to 3rd party }
    - louthy 9d ago
      Your replies here suggest a level of cynicism that is, well, … , it ain’t pretty. In my experience, putting proper compliance procedures in place, following industry best practice in relation to data management and data security actually leads to a more effective organisation, because it professionalises. It’s the first step out of the ad-hoc phase of a startup and into the real world of creating a business with value. It also means as you scale up the personnel in the organisation, there are proper checks and balances in place. When you come to sell your business, if it has a ton of existential risks attached to it, it will be worth less and may even not be sellable at all. So even from a cynical “all I care about is money” point-of-view, you want a business that is sound and isn’t storage for future law suits or fines. Also, the cost of a fine due to a data breach isn’t the only thing to be concerned about. Gross negligence could lead loss of life, loss of property, loss of earnings, etc. and the buck stops with the executives — don’t think you can’t be completely fucked by the good ol’ law as it stands today. Some businesses are more vulnerable than others, but that’s also why you scale the compliance architecture to the business.
      - rpdillon 9d ago
        The person you're replying to is citing the incentives that are created. That's not cynicism, it's analyzing motives to help model outcomes. As for the buck stopping with the executives: can you apply this to a case I've heard of? We have multiple data breaches of companies that scan IDs. We have the Experian breach. We have multiple LastPass breaches. Is there any executive at any of these companies that has been held accountable? I've actually done the legwork on the ones I just mentioned and the answer is there have been no criminal or civil penalties to any individual in an executive role at any of those companies as a result of the data breaches. Maybe I'm missing one?
        louthy 9d ago
        Maybe I wasn’t clear in my message. But the buck stopping with the executives is when ‘the company’ breaks law. Usually because of gross negligence or corporate manslaughter. With my last company, managing medical records, I was always conscious that if we didn’t take our responsibility of managing medical data correctly it could lead to the death of one of my customer’s patients; or some other extreme circumstance that the executives could be held liable for. That was my point about being professional, if you have proper processes in place and audits to prove it, you have protection. And only the most egregious cases would land. It’s good business to protect yourself from a gross negligence or corporate manslaughter claim. It just so happens that it’s good for your customer too. Presumably, the reason you don’t hear much about executives in the dock for these crimes is because most professional organisations put these processes in place. Again, I was just stating that it isn’t just data-breach fines that should encourage executives to professionalise.
  - fc417fc802 9d ago
    It's only an incentive to start caring if it's cheaper than circumventing the law. In other words it won't work unless the aforementioned liability loophole is closed. To rephrase the comment you replied to, if being a cowboy is more profitable (by whatever shady means) then that will generally be preferred by the market. Despite whatever sensibilities you or I might have there is no escaping that simple truth of capitalism.
  - pkaye 9d ago
    I want to see how much be the fine will for this data leak. https://www.dw.com/en/cyberattack-in-berlin-14-million-files-on-the-dark-web/a-79220829 https://www.dw.com/en/cyberattack-in-berlin-14-million-files...
- josephg 9d ago
  > There is no capitalist incentive for the latter This is literally the point of data breach laws like this. To provide a financial incentive to take this stuff seriously.
someguynamedq 8d ago
The bar for not getting hacked is a lot closer to perfect than gross negligence
- louthy 8d ago
  The bar is: do you have effective compliance in place? And are you audited? (ISO27001 [1] or similar). If you are hacked and you are seen to have not given a shit about compliance, or independent penetration tests, or proper documentation of process, with good internal controls enforcing your processes. Then you’re almost certainly vulnerable to a negligence claim. However, if you have all that in place, and somehow something slipped through the net. And once aware you put in new controls to make sure it doesn’t happen again, then you’re very unlikely to have the book thrown at you. You may still get a fine, but it would be much reduced. It’s not hard to do this. Yes, compliance can be overdone, so you need key stakeholders to make sure it doesn’t turn into jobsworth heaven; but the actual implementation isn’t hard to do, and if done well, will improve the processes within the business. It’s very much like an insurance policy. It has some ongoing cost, but it saves you from the one big cost. [1] https://www.iso.org/standard/27001 https://www.iso.org/standard/27001

deepsun 9d ago

But it does create an incentive to not keep data that a company doesn't really need. And that incentive already works with GDPR for PII. This measure add similar incentive for data breaches.