Despite decades of hacking attacks, companies leave sensitive data unprotected

>The European Union has been operating under such a standard since May 2018. Known as the General Data Protection Regulation, the law requires companies to implement security measures to protect sensitive personal data and to promptly notify regulators and affected consumers when it gets compromised. Violations of the data protection rules can result in fines as high as 4% of a business’s annual worldwide sales. “You have to implement cybersecurity measures if you process personal data, and if you do not, you will have a legal problem,” said Stefan Hessel, a cybersecurity specialist in Germany at the Reuschlaw law firm.

>Such measures may in fact make it harder for hackers to ply their trade, if Pompompurin’s postings are any indication. In August he was asked on RaidForums why large collections of personal data always seem to come from the U.S. He responded: “Because its the easiest to get, other countries have load of protection laws & shit, in the US your address is basically public information no matter how hard you try not to be put on lists like this.”

If you're holding a gold bar for me and you lose it, you owe me a gold bar.

If you're holding a photo of my drivers licence and you lose it, nothing happens.

You hit a great point. The law and insurance companies have a major impact on what companies do.

If it's illegal (and they'll get caught) or the insurance companies say "do this to get insurance or if you don't do it the insurance doesn't cover you" people will make change.

That right there is a way to bring change.

Call your gov reps.

Let's get insurance companies to put security controls into coverage policies.

At every layer of nearly every company, nobody has any understanding of information security. Where-as, as a society, we have at least a basic understanding of physical security (we understand the gist of a lock, and use them regularly, and guard the keys), we have basically zero understanding of information security.

I've worked, in some capacity, around information security for nearly my entire career and I have found that even people I highly respect as technologists rarely have any knowledge of information security. Most of the information security side of the industry is filled with people who are trained on compliance and regulations, not on security, and they are seen as completely synonymous. Security has to be layered in order to be effective, yet that's been taken to mean several layers of different types of brightly colored middle-boxes with pretty dashboards, rather than an actual layering of security principles and a reasonable organizational posture. While these things can be tools, they are treated as solutions rather than tools that help you create a solution.

Most SWEs know next to nothing about application security. Most web devs don't even know what OWASP is, much less have any understanding of web security. Most networking folks (even those with Network Security in their title) know little about network protocols and protocol security, instead being glorified firewall rule writers. Most security architects only know about compliance and policy, nothing about actually identifying threat vectors and constructing robust organizational postures. And most executives don't care beyond what's required to comply with the law or their contractual agreements so leave it to "experts".

Most of the "experts" aren't experts. The fraud with information security isn't just what's being perpetrated by attackers, it's also what's being perpetrated by the entire information security industry, which is mostly filled with puff pieces calling themselves "experts" who don't actually understand anything about security at all, as well as vendors who sell security products that themselves may not be secure on the backend but have privileged access within their client's data environments.

All an attacker must do is find your weakest link. What you must do to protect yourself is ensure that your weakest link is stronger than anyone else's strongest link. There's a huge disparity in the effort and investment required, and it's an issue that can't simply be resolved by throwing money at it because most of the people lining up to take your money are their own sort of attacker committing their own sort of fraud.

Do they do that of their own volition, or because there's some legal requirement forcing them to?