When good people get punished
..we all suffer. Why work in IT security if you are personally punished for any failing? We all lose if the talent moves to something less risky. And the talent will move if it's clear that lack of mitigation strategies continue to be ignored. As everyone is saying here, it's not a working system without it. Those who will continue the work will spend otherwise productive time doing cya. So we lose talent, lose productivity, never address the root issue. We will all certainly suffer if the worst of this particular breach comes to pass.
Taking one more step back, there needs to be mitigation for the overall data and personal liability problem. Otherwise companies that get punished for mishandling personal data for their product will stop performing their functions, stop storing personal data altogether... oh wait
Biting the hand that feeds IT
