Earlier quoted context omitted.
This is a fascinating discussion because it betrays two fundamental attitudes of society to risk. RyanZAG is "correct". If someone breaks into my house and steals my TV, then my security was a failure. This leads to the next problem - its not a catastrophic failure in today's (western) society . I am probably out at work, and I am insured, and the burglar is unlikely to be waiting when I get home to murder me. Howeve…
Great perspective! "So its not a judgement on the resources of the attacker that matters, it is the expected consequences of the breach - the expected value of damage." I nodded at this when I mentioned resiliency and recovery, but I still think resources of the attacker matters. A determined attacker could doubtless breach your front door with a battering ram or axe and enough time. Part of the reason you don't worr…
Curiously I am not convinced of the total damage done by these various break-ins. Stealing credit card numbers is not the same as getting the loot into a laundered bank account. Grabbing bitcoin wallets is closer, but the liquidity does not exist to extract much.
The damage is seemingly more reputational, or other internal costs to the hacked company (like paying security consultants). The actual "money the thieves ran off with and could convert into real cash" is pretty thin - would value some pointers at studies here.