Stories
Slash Boxes
Comments

SoylentNews is people

posted by cmn32480 on Thursday October 29 2015, @03:21PM   Printer-friendly
from the need-a-penalty-box dept.

Bruce Schneier's blog talks about the recent hack of CIA director John O. Brennan's AOL account (among others) and says when it comes to social engineering attacks:

The problem is a system that makes this possible, and companies that don't care because they don't suffer the losses. It's a classic market failure, and government intervention is how we have to fix the problem.

It's only when the costs of insecurity exceed the costs of doing it right that companies will invest properly in our security. Companies need to be responsible for the personal information they store about us. They need to secure it better, and they need to suffer penalties if they improperly release it. This means regulatory security standards.

Schneier goes on to suggest the government should establish minimum standards for results and let the market figure out the best way to do it. He also partly blames consumers because they demand any security solutions be easy to use, ending with:

It doesn't have to be this way. We should demand better and more usable security from the companies we do business with and whose services we use online. But because we don't have any real visibility into those companies' security, we should demand our government start regulating the security of these companies as a matter of public safety.

Related: WikiLeaks Publishes CIA Chief's Personal Info


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1, Interesting) by Anonymous Coward on Thursday October 29 2015, @10:24PM

    by Anonymous Coward on Thursday October 29 2015, @10:24PM (#256254)

    Perfect is the enemy of good. How about punishing companies that have shown to be absolutely incompetent when it comes to security, like Sony? Don't demand that people have perfect security; demand that they're not totally incompetent.

    Starting Score:    0  points
    Moderation   +1  
       Interesting=1, Total=1
    Extra 'Interesting' Modifier   0  

    Total Score:   1  
  • (Score: 2) by Tramii on Thursday October 29 2015, @11:35PM

    by Tramii (920) on Thursday October 29 2015, @11:35PM (#256271)

    How about punishing companies that have shown to be absolutely incompetent when it comes to security, like Sony?

    How do you make that work without making it a completely arbitrary process? We prosecute Sony but let Target off the hook? Who get's the decide what is due to "incompetence"? Does incompetence mean that it was the programmer's first time writing secure software? Or does it mean that we expect better security from "big" companies vs. smaller companies?