5 ms·

His statement assumes that the only cost of a database breach is notifying customers.

• Rantenki 12y ago
  His statement was about a single hypothetical database server that would cost more to secure that it was worth. Budgets are finite. That's a fact of life. The trick is balancing the risks and hardening the important things so that, on the balance, you have the most security possible for that budget. Not spending as much money hardening the (hypothetical) legacy DB with a noncritical data of some sort, so that you have more budget to harden the financials database; that is the right decision. Of course, it doesn't look like that balance was struck effectively very often at Sony Pictures, but the theory is sound :)
  • code_duck 12y ago
    I think that potential damage to a company's reputation and possible harm to customers is worth counting. If it's something you'd have to notify customers about... It just be somewhat sensitive data, not public information?