Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sad reality: It's cheaper to get hacked than build strong IT defenses

theregister.co.uk

Post reply on HN
Print view View original

81–90 of 117 posts

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#81

Post by mikeash »

DominikR wrote: post #65
petertodd wrote: post #18

Earlier quoted context omitted.

When your front door isn't secure enough, you and/or your insurance company eat the loss. The point of this headline is that when Yahoo gets attack their customers are going to eat the loss, yet it's Yahoo who screwed up. That's IMO a clear example of mis-aligned incentives.

Has Yahoo acted grossly negligent? (I don't know the specifics in this case) If so then they are liable for resulting damages, if not then they didn't screw up. See, no customer is entitled to a 100% guarantee that their private data will never leak. Why? Because it is not possible to guarantee such a thing. The only thing you are entitled to is that the corporation handles your data following industry standards whic…

It's not possible to 100% guarantee that data will never leak, but it's entirely possible to 100% guarantee that the company will cover the full costs of a leak. If that was somehow a legal requirement, everyone would go out and buy insurance for it and then life would go on, probably with additional emphasis on security.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#82

Post by arcticfox »

DominikR wrote: post #65
petertodd wrote: post #18

Earlier quoted context omitted.

When your front door isn't secure enough, you and/or your insurance company eat the loss. The point of this headline is that when Yahoo gets attack their customers are going to eat the loss, yet it's Yahoo who screwed up. That's IMO a clear example of mis-aligned incentives.

Has Yahoo acted grossly negligent? (I don't know the specifics in this case) If so then they are liable for resulting damages, if not then they didn't screw up. See, no customer is entitled to a 100% guarantee that their private data will never leak. Why? Because it is not possible to guarantee such a thing. The only thing you are entitled to is that the corporation handles your data following industry standards whic…

Yes, we are lamenting the situation. There is no incentive for companies to go beyond the rather lame line of duty. So we're left with an industry full of holes.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#83

Post by nickpsecurity »

paulddraper wrote: post #71
nickpsecurity wrote: post #69

Earlier quoted context omitted.

I think commenter is describing his company's operation, what attacks they were facing, and that listening to advice countered them. Commenter doesn't mention a SQL Injection or claim his case applies to anything else. Instead, merely points out that listening to professionals who understand risks of your technology and following their advise can prevent problems caused by those risks. That was my take.

The difference being -- it's easy to pay somebody else enough to get rid of Dos attacks for you, and you never have to think about it. Penetration isn't quite as easy.

I pointed out here...

https://news.ycombinator.com/item?id=12566098

...that a few, inexpensive practices stop almost all the common methods currently. There's also frameworks and stacks that immunize web applications against common ones for them with little to no effort by developers. These fit parent's claim where you just follow basic, security advice with available tools for each category to stop many attacks.

Now, that's not going to cover everything. A dedicated, professional attacker or team targeting your individual business might break past it all. Most breaches we see, though, are companies not doing the basics.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#84

Post by draw_down »

nathanaldensr wrote: post #66

"Cheaper" is not including the full cost of compromised data. Compromises don't only affect companies' bottom lines, but also those who were compromised. The costs to individuals are undoubtedly much harder to quantify.

Well, sure. I can only imagine companies are happy not to pay that cost and let customers continue to deal with it.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#85

Post by nathanaldensr »

enraged_camel wrote: post #73
nathanaldensr wrote: post #66

"Cheaper" is not including the full cost of compromised data. Compromises don't only affect companies' bottom lines, but also those who were compromised. The costs to individuals are undoubtedly much harder to quantify.

I totally agree, but I think in this case they are saying it's cheaper for the company , which is what really matters in this context (since they're comparing it to how much the company would pay for security). I mean, if the company's website gets hacked and your credit card data is stolen, then your card is charged $1,000, it's not the company that pays for it, right? You either talk to your bank to mark the purcha…

Good point about what the article was comparing. I missed that.

I guess I'm just sour that articles like this tend to gloss over what is often the most important impact of a security breach--the end-users' data and privacy--and instead focus on easy-to-report numbers.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#86

Post by DominikR »

mikeash wrote: post #81
DominikR wrote: post #65

Earlier quoted context omitted.

Has Yahoo acted grossly negligent? (I don't know the specifics in this case) If so then they are liable for resulting damages, if not then they didn't screw up. See, no customer is entitled to a 100% guarantee that their private data will never leak. Why? Because it is not possible to guarantee such a thing. The only thing you are entitled to is that the corporation handles your data following industry standards whic…

It's not possible to 100% guarantee that data will never leak, but it's entirely possible to 100% guarantee that the company will cover the full costs of a leak. If that was somehow a legal requirement, everyone would go out and buy insurance for it and then life would go on, probably with additional emphasis on security.

I have a different position on that. My perspective is that if a company doesn't act negligent, follows all legal procedures and industry standards regarding data security then why should it be made to pay for damages caused by a third party.

It didn't cause the damage, it's been the criminals who did that. They should be held accountable for this.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#87

Post by Spivak »

M_Grey wrote: post #46
raverbashing wrote: post #19

Earlier quoted context omitted.

Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

More like, if you don't put locks on your doors, maybe no one should insure you and maybe the cops shouldn't waste their time when you couldn't be bothered to even take symbolic action to protect yourself.

How dare you! I put a note on the door that says that all unauthorized persons are forbidden from entering the house.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#88

Post by snowwrestler »

vosper wrote: post #55
bsenftner wrote: post #52

Earlier quoted context omitted.

I ran an unsuccessful game service for a while, and due to the nature of our product (custom 3D characters) we suspected to receive and did receive an incredible number of hack attempts for a pretty much unknown web service. Expecting the issue, we got a US $20K SonicWall hardware firewall of the class used by banks. Best investment ever. On four separate occasions we had DoS attacks that the SonicWall shrugged off w…

Are you conflating DoS (something a firewall can deal with) with the kind of hacking that can penetrate a system? I'm not sure a firewall can do anything about (for example) SQL injection.

I'm not familiar with Sonicwall specifically, but a packet-inspecting web app firewall can indeed do something about SQL injections, obvious ones anyway.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#89

Post by mikeash »

DominikR wrote: post #86
mikeash wrote: post #81

Earlier quoted context omitted.

It's not possible to 100% guarantee that data will never leak, but it's entirely possible to 100% guarantee that the company will cover the full costs of a leak. If that was somehow a legal requirement, everyone would go out and buy insurance for it and then life would go on, probably with additional emphasis on security.

I have a different position on that. My perspective is that if a company doesn't act negligent, follows all legal procedures and industry standards regarding data security then why should it be made to pay for damages caused by a third party. It didn't cause the damage, it's been the criminals who did that. They should be held accountable for this.

That seems pretty reasonable too. I like the idea of making the business liable regardless because it more or less automatically optimizes the combined cost of security and losses. Companies will in theory spend money on security until each dollar spent mitigates less than a dollar in losses, then stop.

The trick, of course, is making sure companies estimate their risk properly and don't just screw everyone over by underspending on security and then going bankrupt when hacked. Mandatory liability insurance could help with that, since insurance companies basically exist to assess risk in something like a realistic fashion.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#90

Post by Godel_unicode »

mikeash wrote: post #89
DominikR wrote: post #86

Earlier quoted context omitted.

I have a different position on that. My perspective is that if a company doesn't act negligent, follows all legal procedures and industry standards regarding data security then why should it be made to pay for damages caused by a third party. It didn't cause the damage, it's been the criminals who did that. They should be held accountable for this.

That seems pretty reasonable too. I like the idea of making the business liable regardless because it more or less automatically optimizes the combined cost of security and losses. Companies will in theory spend money on security until each dollar spent mitigates less than a dollar in losses, then stop. The trick, of course, is making sure companies estimate their risk properly and don't just screw everyone over by u…

So you think that startups with hockey-stick growth should have to design systems which are impervious to extremely sophisticated criminals? That seems unlikely.

Edit: also, the main risk here is password reuse. How is Yahoo supposed to estimate that and why are they on the hook for user's bad security practices?

Post reply on HN