3 ms·
I think what people are hinting at, but not explicitly saying is the $10M vs. $1M tradeoff between hardening a database and notifying users is a very narrow per
by Dwolb 12y ago
I think what people are hinting at, but not explicitly saying is the $10M vs. $1M tradeoff between hardening a database and notifying users is a very narrow perspective. They're not weighing the possible monetary losses to their users or possible damage to their reputation.
- growse 12y agoAnd that's one of the many things that makes security hard: effectively weighing impacts against remediation costs (even measuring impacts is really hard). It appears Sony did it badly. But I agree with the statement that it doesn't make sense to spend $10m mitigating against a possible $1m loss.