5 ms·

>So basically their thinking was that getting hacked was just the cost of doing business. Of course, they are now discovering that the cost of a really serious

>So basically their thinking was that getting hacked was just the cost of doing business. Of course, they are now discovering that the cost of a really serious hack is much higher than they thought it was. The HN hive mind victim blaming at it's best. If you bother to read the proper statement it's specifically about one 'hypothetical' database getting breached. "The cost to harden the legacy database against a possible intrusion could come to $10 million, he says. The cost to notify customers in case of a breach might be $1 million. With those figures, says Spaltro, “it’s a valid business decision to accept the risk” of a security breach. “I will not invest $10 million to avoid a possible $1 million loss,” he suggests." And it's a fair statement. You can spend ever spare dollar on IT security and still not be 100% secure, just poor with a crippling system that grinds productivity to a halt. You can see this with the auditor living in gaga land asking employees have passwords with "random letters, numbers and symbols" It is about risk analysis as he had the courage to say out loud and it is what everyone in real world IT security knows.

code_duck 12y ago
His statement assumes that the only cost of a database breach is notifying customers.
- Rantenki 12y ago
  His statement was about a single hypothetical database server that would cost more to secure that it was worth. Budgets are finite. That's a fact of life. The trick is balancing the risks and hardening the important things so that, on the balance, you have the most security possible for that budget. Not spending as much money hardening the (hypothetical) legacy DB with a noncritical data of some sort, so that you have more budget to harden the financials database; that is the right decision. Of course, it doesn't look like that balance was struck effectively very often at Sony Pictures, but the theory is sound :)
  - code_duck 12y ago
    I think that potential damage to a company's reputation and possible harm to customers is worth counting. If it's something you'd have to notify customers about... It just be somewhat sensitive data, not public information?

code_duck 12y ago

His statement assumes that the only cost of a database breach is notifying customers.

Rantenki 12y ago
His statement was about a single hypothetical database server that would cost more to secure that it was worth. Budgets are finite. That's a fact of life. The trick is balancing the risks and hardening the important things so that, on the balance, you have the most security possible for that budget. Not spending as much money hardening the (hypothetical) legacy DB with a noncritical data of some sort, so that you have more budget to harden the financials database; that is the right decision. Of course, it doesn't look like that balance was struck effectively very often at Sony Pictures, but the theory is sound :)
- code_duck 12y ago
  I think that potential damage to a company's reputation and possible harm to customers is worth counting. If it's something you'd have to notify customers about... It just be somewhat sensitive data, not public information?