3 ms·

Not sure I follow. Are you saying that it's sane to spend 10x the value of a thing protecting against the loss of that thing?

• Dwolb 12y ago
  I think what people are hinting at, but not explicitly saying is the $10M vs. $1M tradeoff between hardening a database and notifying users is a very narrow perspective. They're not weighing the possible monetary losses to their users or possible damage to their reputation.
  • growse 12y ago
    And that's one of the many things that makes security hard: effectively weighing impacts against remediation costs (even measuring impacts is really hard). It appears Sony did it badly. But I agree with the statement that it doesn't make sense to spend $10m mitigating against a possible $1m loss.
• felixgallo 12y ago
  How would you value the loss that Sony has faced here? If you guessed more than $1M, you did better than this guy.
  • growse 12y ago
    But that's not the question. No-one's suggesting that Sony considered this specific scenario and arrived at loss impact of $1m, are they? Hindsight is a wonderful thing. An interesting question is this: You're the CISO of a major Hollywood studio. You have a budget of $xx million. Smart, well-resourced people are determined to destroy your company. What do you do?
    • ff6633 12y ago
      Nice try, Scott