5 ms·

Most of the cost of bad security of a business are not borne by the business, but by its customers. Business often do a bad job of weighing externalized costs,

Most of the cost of bad security of a business are not borne by the business, but by its customers. Business often do a bad job of weighing externalized costs, and security is no exception.

akerl_ 11y ago
The business is responsible for the costs against itself, which include any fines, any damage to their revenue due to customers leaving, and any resulting litigation, to name a few. The business isn't responsible for costs borne by customers which don't translate to those customers paying less money. Given that the listed businesses are still operating and in most cases continuing to turn similar profits to what they were doing before, they appear to have done an excellent job weighing the costs in play. You're welcome to think that the cost to the business should be higher, either due to the public caring more (most paying customers at the moment don't even consider whether the businesses they support care about security) or due to increased fines and penalties for security failings. It may very well be that we need to adjust those things via raising awareness or changing legislation. But based on the current state of the world, these businesses all weighed things in a way that kept them doing what they do.
- peterwoo 11y ago
  You guys use the word "seriously" here in an entirely different sense than these statements intend. These aren't statements made to the board, they're PR statements made to outsiders after huge breaches of customer/employee personal info. No one is reassured in these times by a company being "serious" about security in the sense that they have supposedly calculated its expected impact on their profitability. > Given that the listed businesses are still operating and in most cases continuing to turn similar profits to what they were doing before, they appear to have done an excellent job weighing the costs in play. You can't know whether (even in an internal bookkeeping sense) the "tradeoff" was net positive. The incidents still cost the companies money. BP still exists and is highly profitable despite the spill and the ongoing costs incurred. That doesn't mean, hey they must have given it serious thought and found it costs more to inspect and maintain the rig than the $50B+ spent cleaning it up.
  - akshatpradhan 11y ago
    >You guys use the word "seriously" here in an entirely different sense than these statements intend. I don't think security can be taken seriously unless specifically compliance is taken seriously. I claim something that few security professionals would say in their career: Compliance is the magic bullet to taking privacy and security seriously. But to understand why, we have to think about the the most reasonable alternative to compliance as an approach to security. Do you know what “full content packet capture” means? It’s when you’re able to grab every piece of data transmitted over a network using a tool called tcpdump. You can use another tool to reassemble those collected data packets into complete applications, movie or music files, even video chats and phone calls. As a joke, an instructor once told me that when they went onsite to do security investigations, they would do a full content dump; if someone was downloading videos at the time, my instructor would say, “Thanks for the movie, guys!” This is what the Utah Data Center is doing. All packets are collected using a tool like tcpdump, and then the Center reassembles them and categorizes the content into data cubes (e.g., movies, video calls, emails) that are easily findable with open source search engines such as Lucene and Solr. Is this taking security seriously? You bet! Enhanced Intrusions Detection Systems is how security is being taken seriously and with a cost to privacy. If a hosting provider like Akamai — which, runs 15% of the world’s web traffic — is able to reassemble your packets, and even archive them, is that what you want security to be? Probably not, but when a security professional says "let's take security seriously", to them it means just watch all the things. I remember in 2006, after my IDS training, I was all for collecting every single packet (no matter what) because I was taught as a security professional, that was the only way I could do my job: watch everything, since we need to know everything about anything. If you watch everything, that’s inherently security, and the world is protected. That was my modus operandi for many years. This is why taking privacy and security seriously really means taking compliance seriously. Compliance lassos in "watch everything" while also providing validation and proof of security. If we’re doing good hygiene (e.g. Key rotation, log review, Change Control) on our systems, there’s no reason to collect and watch everything. The recipe to collect everything already exists but that means only security is being taken seriously. I hope we start to take compliance seriously and bring that into the privacy/security equation.
    - 11y ago
raesene9 11y ago
I wouldn't say they do a bad job, more that they (perhaps correctly) don't care. If something doesn't hit their bottom line, should a commercial company, who is predicated on providing shareholder value care about it? Personally as distateful as it is, I think the only way to amke companies take proper account of externalities is regulation / law. If you take the example of health and safety, or building regulations, there is a reason why those are (in many countries) enshrined in law and not done by companies spontaneously.
superuser2 11y ago
Maybe if they lose something specific like message content, order history, etc. But businesses are not morally culpable for banks and governments' inexcusable choice of shared secret numbers to prove ownership of identities, bank balances, credit lines, etc. when public key crypto has been available for 20+ years. It should be the entities who deliberately perpetuate broken security architectute like CC numbers, SSNs, paper ID documents, who bear the cost of their inevitable copying. Businesses have to architect for the world we have, yes, but still.

Most of the cost of bad security of a business are not borne by the business, but by its customers. Business often do a bad job of weighing externalized costs, and security is no exception.

akerl_ 11y ago

The business is responsible for the costs against itself, which include any fines, any damage to their revenue due to customers leaving, and any resulting litigation, to name a few. The business isn't responsible for costs borne by customers which don't translate to those customers paying less money. Given that the listed businesses are still operating and in most cases continuing to turn similar profits to what they were doing before, they appear to have done an excellent job weighing the costs in play. You're welcome to think that the cost to the business should be higher, either due to the public caring more (most paying customers at the moment don't even consider whether the businesses they support care about security) or due to increased fines and penalties for security failings. It may very well be that we need to adjust those things via raising awareness or changing legislation. But based on the current state of the world, these businesses all weighed things in a way that kept them doing what they do.

peterwoo 11y ago
You guys use the word "seriously" here in an entirely different sense than these statements intend. These aren't statements made to the board, they're PR statements made to outsiders after huge breaches of customer/employee personal info. No one is reassured in these times by a company being "serious" about security in the sense that they have supposedly calculated its expected impact on their profitability. > Given that the listed businesses are still operating and in most cases continuing to turn similar profits to what they were doing before, they appear to have done an excellent job weighing the costs in play. You can't know whether (even in an internal bookkeeping sense) the "tradeoff" was net positive. The incidents still cost the companies money. BP still exists and is highly profitable despite the spill and the ongoing costs incurred. That doesn't mean, hey they must have given it serious thought and found it costs more to inspect and maintain the rig than the $50B+ spent cleaning it up.
- akshatpradhan 11y ago
  >You guys use the word "seriously" here in an entirely different sense than these statements intend. I don't think security can be taken seriously unless specifically compliance is taken seriously. I claim something that few security professionals would say in their career: Compliance is the magic bullet to taking privacy and security seriously. But to understand why, we have to think about the the most reasonable alternative to compliance as an approach to security. Do you know what “full content packet capture” means? It’s when you’re able to grab every piece of data transmitted over a network using a tool called tcpdump. You can use another tool to reassemble those collected data packets into complete applications, movie or music files, even video chats and phone calls. As a joke, an instructor once told me that when they went onsite to do security investigations, they would do a full content dump; if someone was downloading videos at the time, my instructor would say, “Thanks for the movie, guys!” This is what the Utah Data Center is doing. All packets are collected using a tool like tcpdump, and then the Center reassembles them and categorizes the content into data cubes (e.g., movies, video calls, emails) that are easily findable with open source search engines such as Lucene and Solr. Is this taking security seriously? You bet! Enhanced Intrusions Detection Systems is how security is being taken seriously and with a cost to privacy. If a hosting provider like Akamai — which, runs 15% of the world’s web traffic — is able to reassemble your packets, and even archive them, is that what you want security to be? Probably not, but when a security professional says "let's take security seriously", to them it means just watch all the things. I remember in 2006, after my IDS training, I was all for collecting every single packet (no matter what) because I was taught as a security professional, that was the only way I could do my job: watch everything, since we need to know everything about anything. If you watch everything, that’s inherently security, and the world is protected. That was my modus operandi for many years. This is why taking privacy and security seriously really means taking compliance seriously. Compliance lassos in "watch everything" while also providing validation and proof of security. If we’re doing good hygiene (e.g. Key rotation, log review, Change Control) on our systems, there’s no reason to collect and watch everything. The recipe to collect everything already exists but that means only security is being taken seriously. I hope we start to take compliance seriously and bring that into the privacy/security equation.
  - 11y ago

raesene9 11y ago

I wouldn't say they do a bad job, more that they (perhaps correctly) don't care. If something doesn't hit their bottom line, should a commercial company, who is predicated on providing shareholder value care about it? Personally as distateful as it is, I think the only way to amke companies take proper account of externalities is regulation / law. If you take the example of health and safety, or building regulations, there is a reason why those are (in many countries) enshrined in law and not done by companies spontaneously.

superuser2 11y ago

Maybe if they lose something specific like message content, order history, etc. But businesses are not morally culpable for banks and governments' inexcusable choice of shared secret numbers to prove ownership of identities, bank balances, credit lines, etc. when public key crypto has been available for 20+ years. It should be the entities who deliberately perpetuate broken security architectute like CC numbers, SSNs, paper ID documents, who bear the cost of their inevitable copying. Businesses have to architect for the world we have, yes, but still.