Well physical security is the same. You could make your house entirely thief proof but nobody does because the cost isn't worth it.
Sad reality: It's cheaper to get hacked than build strong IT defenses
11–20 of 117 posts
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#12Yes, you notice it when you deal with sites where bad security can be costly, like on a (bit)coin exchange (i.e. Bittrex). You get an email at every successful login, 2FA is encouraged from the start, enabling the API keys requires 2FA, Google reCAPTCHA at every login, logout as soon as you close the browser, api keys with different levels of functionality, API requires SHA512 hashing of API key and API code and a ti…
Seriously? Bitfinex was the latest, greatest bitcoin business with a security breach, and they just pushed the losses onto their customers. Bad security at bitcoin exchanges does not generally affect the company itself, but the users.
Volume at Bitfinex has gone _way_ down; bad security is definitely costing them in lost business. Equally, how could those losses not get pushed onto customers? They were larger than the assets the company had available.
Bitcoin services aren't a good example here - they're very different than data breaches. If anything, they're a rare example of a case where hacks usually do lead to the destruction of the company; that Bitfinex wasn't killed immediately is an exception, not the norm.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#13Why is that "sad"? Nature has gone the same path. We have basic defenses that are "on" all the time (passive immune system - nonspecific), and we have an adaptive response that reacts to what actually happens to us, which also means threats we actually encounter will be recognized and fought more quickly and better in the future. Or houses - having lived in the US, those front doors are at least an order of magnitude less secure than any German front door, but even those are not really able to keep out any determined intruder.
Why should be mount a very expensive all-out defense against a lot of perceived threats? It's similar to "every child (programmer, etc.) MUST know this!". Making demands is easy. If people don't care there probably is a deeper reason. Yes, the heuristic gets it wrong, that's why it's a heuristic, but that it is one in the first place also has similar reasons.
It sure is possible to criticize a concrete company for concrete problems, but the blanket statement of the headline is not useful.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#14I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.
And I get downvoted for saying self-driving car companies should be fined signficant amounts of money for both car accidents due to poor self-driving software capabilities but also for security breaches.
What if it's "cheaper" for the car companies to let the cars crash than adopt stronger security? You may think that there's no way a recall would be worth it, but we're already seeing companies such as Tesla "fix" the issue over the air, and chances are most of the new self-driving cars will be fixed the same way, if not all.
The only thing that would be left is the "bad PR", which may be much smaller in the future, because there won't be any recalls. If only 2 people die, and then all cars are fixed, the outrage just won't be as big as when 100 people die due to a brake malfunction, and then 5 million cars have to be recalled, impacting 5 million people (as opposed to only the families of those two in the former example) that would then personally spread the bad news.
Also the "bad PR" doesn't seem to affect tech companies, or even retailers, or banks, all that much, so I doubt it would affect car companies that much more in the future (for the reasons I mentioned above).
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#15I think it's possible the global economy literally could not take the expense of actually making everything secure.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#16Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#17One reason it's true is because companies only measure actual cost, not opportunity cost. How much did it cost Yahoo to have every tech-savvy person in the world switch to Gmail because of Yahoo's lousy (and Google's excellent) security infrastructure? Where the tech-savvy go, the tech-unsavvy often follow. As they did with Gmail. But lost revenue opportunities don't show up in the bottom line, so cost-focused manage…
Not sure I agree that it was Google and Yahoo's respective security architecture that caused people to switch, even tech-savvy people.
Sure. But all the things Gmail offered were things that probably looked like lousy investments to Yahoo. Why offer more storage? Why have better spam filtering? Why have better security? It all costs money!!!
The point is only looking at actual cost, not opportunity cost.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#18Why is that "sad"? Nature has gone the same path. We have basic defenses that are "on" all the time (passive immune system - nonspecific), and we have an adaptive response that reacts to what actually happens to us, which also means threats we actually encounter will be recognized and fought more quickly and better in the future. Or houses - having lived in the US, those front doors are at least an order of magnitude…
When your front door isn't secure enough, you and/or your insurance company eat the loss. The point of this headline is that when Yahoo gets attack their customers are going to eat the loss, yet it's Yahoo who screwed up.
That's IMO a clear example of mis-aligned incentives.
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#19I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.
Which teenager hackers?
Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around
You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras
Re: Sad reality: It's cheaper to get hacked than build strong IT defenses
#20I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.
I get what you mean, but poor defense ain't no excuse to hack the hell out of company, neither legally nor morally. plus i don't buy the notion that some teenager had no clue what he was doing would harm other's livehood (if yes, then he should go through psychiatric evaluation).
if I don't put 3m electric fence with automatic sentry guns around my whole hypothetical house and land, does it mean everybody is automatically invited to freely try to break in, do damage, steal my stuff or post my private and legal data online for others?
state should have better use for these guys, but there should definitely be punishment, not reward in any way. that's how all countries run these days