Sad reality: It's cheaper to get hacked than build strong IT defenses

Pinto was one of the few times a reputation took a sustained hit

Decades later everyone still quotes it (that and the "Ratner Effect"). A few contributing factors:

(1) it was a stark pricing of life - in public spaces we're too squeamish to do this (see the "can't put a price on human life" items posted on every public heath decision)

(2) it used that pricing to directly drive company behaviour, rather than pretending to be "nice" (we all know that companies run on cash not cuddles, but we'd prefer to believe it otherwise and they spend a lot of advertising bucks on the pretence)

(3) it was a company still thought of as a cornerstone of the American Dream (early 70s, US car firms still coasting on fumes of previous glories)

(4) it was novel (the public revelation, if not the behaviour)

(5) for whatever reasons brand identities matter in that sector: automobile manufacturers like to tout their legacies. In IT who does, other than IBM (and that's pretty hollow nowadays)? Some firms "re-invent" themselves, like HP/Compaq/whatever-the-fuck-is-left-of-them-now, some supposedly valuable identities get transplanted like McAfee (private/Intel/make-us-an-offer)

Since this doesn't apply when a dot-com loses our personal data (most of us lack a similarly visceral reaction of its value and with so many similar cases in recent years there's no sustained shock) we can't hope that the risk to the reputation will be a useful deterrent. So if we don't want the damage externalised (i.e. shat all over the customers, as it is today) are we looking at somehow devising standards and imposing serious penalties? (so much devilry in the details of how standards should be developed and compliance tested, etc)

It's yet another example of biased risk-awareness.

You can take a service - let's say...a calendar. You've got a choice of going with provider A, who will give you a product that's free but with a few adverts and some behind-the-scenes data-slurping and the possibility that any details you give them may end up being sold in bulk by whichever unscrupulous group has compromised the security of that organisation.

Or you go with company B, who don't give you adverts, don't mine your data and invest heavily in their cyber-security platforms - but it'll cost you £10 a month for a product of a comparable standard.

Probably 95% of people would go for the former, and accept the risk that there's a very slight chance that some of their credentials will be compromised. If company A doesn't need your address and bank details, then the compromise is an inconvenience to the average user. If company B is compromised - and let's remember that no connected system can ever be 100% secure - then potentially you'll be exposed to a significantly larger loss - not just getting spammed for viagra and russian brides, but you may lose real beans-and-beers money from your bank account or credit card.

So yeah. I don't like the message but I kind of understand it. It feels like people increasingly see "being hacked" in the same vein as getting a speeding ticket - you do what you can to avoid it, and if it happens you'll be annoyed, but it's not the end of the world.

Interesting.

I was of the understanding that cyber insurance wouldn't pay out if you were found to have taken less than adequate measures to protect your data assets.

A bit like home insurance, having it doesn't excuse you from having to lock your doors when you're out.

What about externalised costs?

Curious to know to what degree affected companies have been able to externalise the costs of data breaches. What price can we put on the hassle / worry / embarrassment / waste of time / personal financial loss accruing to the people whose data is lost?

Companies won't invest in good security until they are liable for the true and full costs of their greed, laziness and incompetence. We need to push our politicians to formulate laws and enable compensation schemes that make it too expensive to be cavalier about security.

Ultimately the decision is to be taken en-masse by the buying public, and time and time again the public proves it couldn't give a rats if a) They've not yet suffered personally and b) Insecure company A is cheaper. For example, look up phone/broadband in the UK, you'll almost certainly find TalkTalk is cheapest and they're getting new customers even as we speak yet everyone remembers their data breach, which proves TalkTalk were right to do a piss poor job as long as people can save about £20-£30 a year.

Eh?

That average seems pretty low. They always seem to cost a whole lot more when it actually comes to sentencing the disillusioned kid still hiding underneath the bed.

Not sure attributing the cost of plugging a hole that shouldn't have been there in the first place, is entirely fair.

The author of the report clearly knows nothing about cyber insurance.

How can a cyber insurance company know anything about the actual state of a company's cyber insurance when its primary data intake is a 9 page, user filled out form?

What cyber insurance company's do is 2 buckets:

1) Value at risk: how much would they possibly have to pay. This part, they can judge reasonably well.

2) Is the insuree trying at all? Trying but incapable? Not trying?

That's where the industry is at right now, and will continue to be until some way of understanding "good" security vs. "bad" security can be automatically and easily computed.

Capitalism

This is the kind of insanity that inevitably happens as a consequence of the mindless pursuit of wealth/capital for the sake of acruing more wealth/capital. Eventually no one wins, we're not quite there yet, soon enough we will be.

PS Marx had a thing or two to say about this kind of degeneracy.

PPS AC because of all the neo-con cuntz that lurk here

Wrong.

Strong security is about hiring competent people, and has nothing to do with paying for "top shelf systems". The two most important softwares for a strong security presence are completely free.

Take it from this poor health American. Insurance is not the answer.