Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sad reality: It's cheaper to get hacked than build strong IT defenses

theregister.co.uk

Post reply on HN
Print view View original

41–50 of 117 posts

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#41

Post by emodendroket »

Noseshine wrote: post #13

Why is that "sad"? Nature has gone the same path. We have basic defenses that are "on" all the time (passive immune system - nonspecific), and we have an adaptive response that reacts to what actually happens to us, which also means threats we actually encounter will be recognized and fought more quickly and better in the future. Or houses - having lived in the US, those front doors are at least an order of magnitude…

Because there are significant external costs that the entities sloppily handling records don't have to pay but the rest of us do. Presumably that's the reference they had in mind when they referred to the "Ford Pinto formula," since it's unlikely customers would have agreed that it was better to have cars that had some risk of blowing up and killing them so Ford could make more money.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#44

Post by rbc »

I think a lot of these problems could be nipped in the bud by more aggressive code auditing and patch management. It's better to start with fewer zero-day vulnerabilities. Once the zero-day exploits are out there, you have to act to mitigate them. Another way to think about it is to compare it to home construction.

You have to use good building materials to start. After the house is built, you get into the decision cycle of maintaining, repairing or replacing the home.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#45

Post by M_Grey »

vfxGer wrote: post #7

I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.

All that needs to happen is for a court to define poor IT security as an "Attractive Nuisance", and just generally make companies liable for their customer's information (and more broadly if possible).

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#46

Post by M_Grey »

raverbashing wrote: post #19
vfxGer wrote: post #7

I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.

Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

More like, if you don't put locks on your doors, maybe no one should insure you and maybe the cops shouldn't waste their time when you couldn't be bothered to even take symbolic action to protect yourself.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#47

Post by josaka »

This may change as the plaintiff's bar gets more sophisticated. Many probably remember the Home Depot data breach a few years ago. The card issuers brought a class action against HD and the complaint (under MDL No. 14-02583-TWT) reads like a nice treatise on causes of action in various states implicated by a breach.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#48

Post by codedokode »

jazzyb wrote: post #29
codedokode wrote: post #23

Earlier quoted context omitted.

Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.

I don't understand the point your trying to make. In most recent high-profile hacking cases, hackers stole customer information (including credit card numbers) from the businesses. The financial fall-out for those customers could be much worse than a physical robbery.

Stealing money can be robbing, I agree.

But (this is unrelated matter) why is it possible to steal someone's money just by copying several short numbers? We have all kinds of advanced cryptography today but some payment systems still rely on transistor era technologies.

And even worse, companies can track customers using CC numbers. That is wrong too. The shop should not get your name or other unique identifier when you just buy something with a card.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#49

Post by cmurf »

Yahoo customers are advertisers, not people with email accounts. Account holders are just a resource, and in aggregate I'm willing to bet most won't know what this hack means to them, even if they learn about it. What are they chances they lose 30% or more of this resource, users terminating their accounts? The stock price suggests the account holders don't care or have no meaningful recourse.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#50

Post by jdc0589 »

unless you work in an industry that deals with fairly private and regulated data, but aren't a huge company with tons and tons of cash to burn. Then you are horrendously screwed.

The hardened security infrastructure is still extremely expensive to implement and maintain. You can't just deal with breaches because the fines (straight from Uncle Sam) can be huge relative to your profits. Even if the fines weren't bad enough at face value, you aren't a huge corporate giant, so customer churn after a bad enough breach is going to be worse than it would be for a bigger/older company. You are also paying large insurance premiums that don't even fully cover the fallout of a potential breach.

Post reply on HN