3 ms·

When Startups Don’t Lock the Doors

29 points by RougeFemme 13y ago

BadassFractal 13y ago
Don't remember last time a company got really hurt by leaking their customers' emails, passwords or CC numbers. It's usually "oops, call your CC company and change your number, sorry" and then the news is old when another company gets the same treatment 2 days later.
- objclxt 13y ago
  E-mails and passwords are one thing, credit card numbers are quite another. Firstly, you're going to get sued. Some law-firm is going to figure out you're a decent target, find someone aggrieved enough to be a lead plaintiff, and sue you. Maybe the law-suit is baseless, but you're still going to have deal with the expense and hassle of defending yourself. This is not cheap. The credit card issuers will come after you to reimburse them for fraudulent activity (because your merchant agreement almost certainly has a clause holding you liable should you be responsible for a data breach). Oh, and now the payment networks are insisting you provide a full PCI compliance audit, at your own significant expense. And whilst the Targets of this world typically have indemnity insurance that covers this kind of thing, Joe Startup does not. So yes, the news cycle is brief, and maybe the PR damage is minimal, but that's not what's going to hurt you. What's going to hurt you is the pain and headache of wading through the legal and financial crap-storm that's coming your way.
  - mathattack 13y ago
    As a customer, I might actually rather have someone get my credit card than a password. The bank will find the credit card fraud quicker than a website finding out my password has been compromised. And if someone gets an email account's password, a lot of damage can be done.
- meowface 13y ago
  It's hard to know just how much a breach does affect a company in each case, but I would say it is not nearly as simple as that. If sensitive information like passwords (hashed or not) and credit card numbers are released, a company has to spend hundreds or thousands of man-hours dealing with the breach. They often are expected to pay for credit reporting/anti identify theft services for all affected customers, there are lots of legal requirements, customer relations has to go into overdrive, and if the company is a financial firm or must be PCI compliant then all of that may be amplified. Customers might even sue you, especially if there's evidence of some negligence. Of course, they must also conduct an investigation of the breach, which for most companies involves hiring a contractor like Mandiant or Fidelis to determine how it happened, exactly what was taken, what the purpose was, etc. Was source code or other intellectual property stolen? Did the attacker leave very subtle backdoors? Could they try and attack us again later based on admin passwords or portals they found? Incident response service companies charge hefty fees for that kind of work. Then they'll need to perform heavy security audits to ensure the hole, if there is a specific one, is patched. If it happened via spear phishing then lots of employee training will have to take place. If it was a server running some unpatched software then a vulnerability management program will have to be created (though any tech company should probably have one already). More money will end up being spent on security services and systems, security staff, and proper training. All of that is still assuming the company's reputation and trust isn't damaged; in many cases it seriously is. Prospective customers may be reluctant to use the service and current customers may switch. I imagine tptacek could give some more useful information here, as could any business owner who's dealt with a serious security breach. From working in the security industry though, I can tell you that most business owners likely consider a breach on the level of leaking CC numbers to be a nightmare.

29 points by RougeFemme 13y ago

Don't remember last time a company got really hurt by leaking their customers' emails, passwords or CC numbers. It's usually "oops, call your CC company and change your number, sorry" and then the news is old when another company gets the same treatment 2 days later.

objclxt 13y ago
E-mails and passwords are one thing, credit card numbers are quite another. Firstly, you're going to get sued. Some law-firm is going to figure out you're a decent target, find someone aggrieved enough to be a lead plaintiff, and sue you. Maybe the law-suit is baseless, but you're still going to have deal with the expense and hassle of defending yourself. This is not cheap. The credit card issuers will come after you to reimburse them for fraudulent activity (because your merchant agreement almost certainly has a clause holding you liable should you be responsible for a data breach). Oh, and now the payment networks are insisting you provide a full PCI compliance audit, at your own significant expense. And whilst the Targets of this world typically have indemnity insurance that covers this kind of thing, Joe Startup does not. So yes, the news cycle is brief, and maybe the PR damage is minimal, but that's not what's going to hurt you. What's going to hurt you is the pain and headache of wading through the legal and financial crap-storm that's coming your way.
- mathattack 13y ago
  As a customer, I might actually rather have someone get my credit card than a password. The bank will find the credit card fraud quicker than a website finding out my password has been compromised. And if someone gets an email account's password, a lot of damage can be done.
meowface 13y ago
It's hard to know just how much a breach does affect a company in each case, but I would say it is not nearly as simple as that. If sensitive information like passwords (hashed or not) and credit card numbers are released, a company has to spend hundreds or thousands of man-hours dealing with the breach. They often are expected to pay for credit reporting/anti identify theft services for all affected customers, there are lots of legal requirements, customer relations has to go into overdrive, and if the company is a financial firm or must be PCI compliant then all of that may be amplified. Customers might even sue you, especially if there's evidence of some negligence. Of course, they must also conduct an investigation of the breach, which for most companies involves hiring a contractor like Mandiant or Fidelis to determine how it happened, exactly what was taken, what the purpose was, etc. Was source code or other intellectual property stolen? Did the attacker leave very subtle backdoors? Could they try and attack us again later based on admin passwords or portals they found? Incident response service companies charge hefty fees for that kind of work. Then they'll need to perform heavy security audits to ensure the hole, if there is a specific one, is patched. If it happened via spear phishing then lots of employee training will have to take place. If it was a server running some unpatched software then a vulnerability management program will have to be created (though any tech company should probably have one already). More money will end up being spent on security services and systems, security staff, and proper training. All of that is still assuming the company's reputation and trust isn't damaged; in many cases it seriously is. Prospective customers may be reluctant to use the service and current customers may switch. I imagine tptacek could give some more useful information here, as could any business owner who's dealt with a serious security breach. From working in the security industry though, I can tell you that most business owners likely consider a breach on the level of leaking CC numbers to be a nightmare.