Sad reality: It's cheaper to get hacked than build strong IT defenses • Hacker News Board

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#21

Post by hannob » Fri, Sep 23, 2016, 1:08 PM UTC

I wonder if one of the problems is that the focus is too much on costs.

What I see all the time in IT security that for many people doing security means spending lots of money on products with highly questionable promises. It's very doubtful that many of the security appliances you can see at RSA or Black Hat do any good, in many cases they add additional risks. But the industry is selling a story that the more boxes you buy and put in front of your network the better.

For a lot of companies there are very cheap things they could do to improve their security. This starts with such simple things as documenting on the webpage who outside security researchers should contact if they think they found an issue in the companies infrastructure.

So I have quite some doubts that the formula "spending more on security == better security" holds.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#22

Post by yomly » Fri, Sep 23, 2016, 1:38 PM UTC

jpindar wrote: post #16

karmelapple wrote: post #9

Earlier quoted context omitted.

Fully agreed. It was all about a lot of free storage space.

And spam. Yahoo accounts got so much spam.

For a long while you had to configure Yahoo to actually store sent mail, otherwise once sent it was gone for good.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#23

Post by codedokode » Fri, Sep 23, 2016, 1:41 PM UTC

raverbashing wrote: post #19

vfxGer wrote: post #7

I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.

Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#24

Post by edc117 » Fri, Sep 23, 2016, 1:43 PM UTC

Noseshine wrote: post #13

Why is that "sad"? Nature has gone the same path. We have basic defenses that are "on" all the time (passive immune system - nonspecific), and we have an adaptive response that reacts to what actually happens to us, which also means threats we actually encounter will be recognized and fought more quickly and better in the future. Or houses - having lived in the US, those front doors are at least an order of magnitude…

Because attacks in software are always getting better, not worse. If it's a smaller company it's a shame - many of them simply don't have the resources to dedicate to properly hardening themselves against attack, and it can destroy their company.

Places like Yahoo have no such excuse.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#25

Post by coldcode » Fri, Sep 23, 2016, 1:45 PM UTC

codedokode wrote: post #23

raverbashing wrote: post #19

Earlier quoted context omitted.

Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.

Money, lost business, customer data are valuable things and hardly nothing.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#26

Post by raesene6 » Fri, Sep 23, 2016, 1:48 PM UTC

jrochkind1 wrote: post #15

I think it's possible the global economy literally could not take the expense of actually making everything secure.

Definitely not if it was implemented in a big-bang, but a more gradual approach might work.

The counterpoint of what will the costs be if we carry on with the current level of security and drive IT systems more into everyone's lives has to be considered too.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#27

Post by raverbashing » Fri, Sep 23, 2016, 1:48 PM UTC

codedokode wrote: post #23

raverbashing wrote: post #19

Earlier quoted context omitted.

Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.

If they're taking password from users (and maybe even other data like Credit Card numbers - regardless of the security failures of the site), they are taking something from you

Blaming the victim is easy.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#28

Post by arobertson » Fri, Sep 23, 2016, 1:52 PM UTC

saiya-jin wrote: post #20

vfxGer wrote: post #7

I am sick of seeing headlines about teenager hacker being put in jail. It's not because they are geniuses it's because of poor IT defense. The companies should be severely fined for criminal negligence.

I get what you mean, but poor defense ain't no excuse to hack the hell out of company, neither legally nor morally. plus i don't buy the notion that some teenager had no clue what he was doing would harm other's livehood (if yes, then he should go through psychiatric evaluation). if I don't put 3m electric fence with automatic sentry guns around my whole hypothetical house and land, does it mean everybody is automati…

I don't think the house analogy works. You don't keep other peoples stuff at your house. If you ran a storage warehouse, I'm pretty sure your customers would expect you to have adequate security. If a customer came in through the back door of my warehouse, and told me the lock doesn't work, I wouldn't punish him. I would fix the lock.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#29

Post by jazzyb » Fri, Sep 23, 2016, 1:52 PM UTC

codedokode wrote: post #23

raverbashing wrote: post #19

Earlier quoted context omitted.

Which teenager hackers? Yes, if the IT defenses are poor and they get in fair enough, another one is if they get the password list and shop around You're saying like it's ok to rob the house with only one lock as opposed to the one with several locks and security cameras

Hacking is not the same as robbing. Hacker doesn't take anything away from you, except some reputation.

I don't understand the point your trying to make. In most recent high-profile hacking cases, hackers stole customer information (including credit card numbers) from the businesses. The financial fall-out for those customers could be much worse than a physical robbery.

Re: Sad reality: It's cheaper to get hacked than build strong IT defenses

#30

Post by raesene6 » Fri, Sep 23, 2016, 1:53 PM UTC

Noseshine wrote: post #13

Why is that "sad"? Nature has gone the same path. We have basic defenses that are "on" all the time (passive immune system - nonspecific), and we have an adaptive response that reacts to what actually happens to us, which also means threats we actually encounter will be recognized and fought more quickly and better in the future. Or houses - having lived in the US, those front doors are at least an order of magnitude…

Consider many other product markets, when there is a defect in someone's product there are legal remedies. These are in place to provide an incentive for companies to do something they otherwise would not.

Examples of this would be food safety legislation, fire safety legislation, building regulations etc. In all those cases it was considered a good thing (by society) to implement laws to make companies take these things into account.

IT in general, lack this kind of legislation, and as a result companies unsurprisingly make commercial decisions not to improve security where they feel it would cost a lot of money to do so.

The problem comes in the negative externality, the company with bad security isn't the company that takes the loss, similar to the negative externality that the person who made a weak bridge likely doesn't die when it collapses.

So a logical argument might be to use legislation to fix this externality and make it a better decision for companies to improve their security...