4 ms·

Are tech companies that store a fair amount of personally identifying information on millions of people ever subject to security audits? Not saying it would hel

Are tech companies that store a fair amount of personally identifying information on millions of people ever subject to security audits? Not saying it would help, but it seems like as attacks get more prevalent and old security practices become obsolete that users might be able sue companies for negligence by not using optimal data encryption. Of course the tech company would counter sue for stupid passwords. And even if they want to restrict users from dictionary passwords with symbol replacements, hey, it's patented.

jaredmcateer 13y ago
I think in N. America if you do credit card processing you have to conform to PCI standards, unfortunately those standards are loosely audited and relies mostly on self-reporting. More than a few of the security protocols are cargo culty and even detrimental to security.
- deleted 13y ago
  [deleted]
  - imbriaco 13y ago
    Before you decide to be condescending, you should probably freshen up yourself. The vast majority of merchants fall into PCI-DSS Level 2-4. Those merchants complete a self-assessment questionnaire (SAQ), in other words, self-reporting. They also have to pass a rather rudimentary quarterly automated scan from an approved vendor. You don't get to external auditors until you get to Level 1, which is a vanishingly small percentage of the merchants in the world.
fizx 13y ago
My understanding is that the first time you are big enough and screw anything up (leak some PII, mess up your privacy policy, etc), the FTC gets involved on behalf of the citizens, and then you settle with them, the terms of which include ISO-whatever compliant audits for the next few dozen years. So Facebook, Twitter, Google, Dropbox are very likely getting audited yearly. I don't know whether e.g. Pinterest has screwed up yet, so they might not be.

4 ms·

Are tech companies that store a fair amount of personally identifying information on millions of people ever subject to security audits? Not saying it would hel

by hashmymustache 13y ago

jaredmcateer 13y ago
I think in N. America if you do credit card processing you have to conform to PCI standards, unfortunately those standards are loosely audited and relies mostly on self-reporting. More than a few of the security protocols are cargo culty and even detrimental to security.
- deleted 13y ago
  [deleted]
  - imbriaco 13y ago
    Before you decide to be condescending, you should probably freshen up yourself. The vast majority of merchants fall into PCI-DSS Level 2-4. Those merchants complete a self-assessment questionnaire (SAQ), in other words, self-reporting. They also have to pass a rather rudimentary quarterly automated scan from an approved vendor. You don't get to external auditors until you get to Level 1, which is a vanishingly small percentage of the merchants in the world.
fizx 13y ago
My understanding is that the first time you are big enough and screw anything up (leak some PII, mess up your privacy policy, etc), the FTC gets involved on behalf of the citizens, and then you settle with them, the terms of which include ISO-whatever compliant audits for the next few dozen years. So Facebook, Twitter, Google, Dropbox are very likely getting audited yearly. I don't know whether e.g. Pinterest has screwed up yet, so they might not be.