3 ms·

I think what should happen is there should be laws that place sanctions on these companies for negligence in failure to secure their systems. That money should

I think what should happen is there should be laws that place sanctions on these companies for negligence in failure to secure their systems. That money should then go into a fund to provide security monitoring and consulting/auditing services for these businesses, retribution for those who have suffered losses due to the breaches. They clearly can't get it together and there needs to start being punishments (fine/jail) for the IT executives responsible. I hate to approach a problem with more regulation, but market forces haven't been working. I think there should be at the minimum threat of personal consequences for the executives if it is found they were negligent in their duties in any way to provide reasonable security for their systems, and to have processes in place to review code to ensure it does not have blatant security issues.

prawn 12y ago
Wouldn't that cripple any new business storing user details? If these big businesses with large, dedicated security teams can't secure their systems against persistent hackers, what hope do us smallfry have? Often it seems to me that two ways of avoiding trouble are to avoid commodity solutions that can be automatically exploited (e.g., Wordpress, Drupal, Joomla, common plug-ins, etc) and staying under the radar. If you're big or holding especially valuable data, you'll be targeted.
SoftwareMaven 12y ago
This is a horrible idea. It will immediately stifle all innovation in software. The only laws I would be in favor of are required transparency laws where you have to report all breaches with serious fines/jail for failure to comply. The market will quickly sort things out if it has the appropriate information. People can then decide what privacy is valuable for themselves.
- anigbrowl 12y ago
  The only laws I would be in favor of are required transparency laws where you have to report all breaches with serious fines/jail for failure to comply. This is already the case. The information comes from JPM's (mandatory) SEC filings. I forget the time frame but stuff like this (information that could reasonably be expected to have a material impact on the stock price) has to be reported within a pretty narrow window of becoming known to management, like 72 hours or so. The market will quickly sort things out if it has the appropriate information. By all appearances the opposite is true. I mean, where do you move your business to? I have no idea which is the most secure bank, only which ones have so far discovered and reported breaches. Neither Target nor Home Depot seem to have been punished very severely by the market if their stock prices are anything to go by.
  - SoftwareMaven 12y ago
    What was the actual information taken? How was the breach perpetrated? Two pretty big pieces of information we are missing. There may also be daily breaches that aren't significant enough to impact earnings that we never hear about. No, we do not have any kind of transparency. The second issue (where do I go?) can't be worked out at all until we have some idea of "where do I really not want to be?"
    - anigbrowl 12y ago
      First you said you wanted a report of all breaches, now you're asking for the investigation to be run in public - rather a massive move of the goalposts. Without expressing any sympathy for the banks, I'm having trouble thinking of any business that would be willing or even able to do business under such conditions.
      - SoftwareMaven 12y ago
        No, what I'm saying is that we don't have transparency in the reports. All we get is "something happened", with very few details of what "something" is. My goalposts never moved; only your interpretation of them. Would you not agree that a data breach brought on by a disgruntled employee selling records is materially different than the same data breach caused by failure to patch systems? I don't care about the investigation (where did you get any implication I think investigations should be public); I care about the results.
        enraged_camel 12y ago
        This sentence: >>Would you not agree that a data breach brought on by a disgruntled employee selling records is materially different than the same data breach caused by failure to patch systems? Directly contradicts this one: >>I don't care about the investigation (where did you get any implication I think investigations should be public); I care about the results. The result is that people's credit card information got stolen. The investigation and the details -- i.e. whether it was an internal or external breach -- are not relevant to me as the customer.

prawn 12y ago

Wouldn't that cripple any new business storing user details? If these big businesses with large, dedicated security teams can't secure their systems against persistent hackers, what hope do us smallfry have? Often it seems to me that two ways of avoiding trouble are to avoid commodity solutions that can be automatically exploited (e.g., Wordpress, Drupal, Joomla, common plug-ins, etc) and staying under the radar. If you're big or holding especially valuable data, you'll be targeted.

SoftwareMaven 12y ago

This is a horrible idea. It will immediately stifle all innovation in software. The only laws I would be in favor of are required transparency laws where you have to report all breaches with serious fines/jail for failure to comply. The market will quickly sort things out if it has the appropriate information. People can then decide what privacy is valuable for themselves.

anigbrowl 12y ago
The only laws I would be in favor of are required transparency laws where you have to report all breaches with serious fines/jail for failure to comply. This is already the case. The information comes from JPM's (mandatory) SEC filings. I forget the time frame but stuff like this (information that could reasonably be expected to have a material impact on the stock price) has to be reported within a pretty narrow window of becoming known to management, like 72 hours or so. The market will quickly sort things out if it has the appropriate information. By all appearances the opposite is true. I mean, where do you move your business to? I have no idea which is the most secure bank, only which ones have so far discovered and reported breaches. Neither Target nor Home Depot seem to have been punished very severely by the market if their stock prices are anything to go by.
- SoftwareMaven 12y ago
  What was the actual information taken? How was the breach perpetrated? Two pretty big pieces of information we are missing. There may also be daily breaches that aren't significant enough to impact earnings that we never hear about. No, we do not have any kind of transparency. The second issue (where do I go?) can't be worked out at all until we have some idea of "where do I really not want to be?"
  - anigbrowl 12y ago
    First you said you wanted a report of all breaches, now you're asking for the investigation to be run in public - rather a massive move of the goalposts. Without expressing any sympathy for the banks, I'm having trouble thinking of any business that would be willing or even able to do business under such conditions.
    - SoftwareMaven 12y ago
      No, what I'm saying is that we don't have transparency in the reports. All we get is "something happened", with very few details of what "something" is. My goalposts never moved; only your interpretation of them. Would you not agree that a data breach brought on by a disgruntled employee selling records is materially different than the same data breach caused by failure to patch systems? I don't care about the investigation (where did you get any implication I think investigations should be public); I care about the results.
      - enraged_camel 12y ago
        This sentence: >>Would you not agree that a data breach brought on by a disgruntled employee selling records is materially different than the same data breach caused by failure to patch systems? Directly contradicts this one: >>I don't care about the investigation (where did you get any implication I think investigations should be public); I care about the results. The result is that people's credit card information got stolen. The investigation and the details -- i.e. whether it was an internal or external breach -- are not relevant to me as the customer.