Re:Fantasy Math Is Helping Companies Spin Losses into Profits
by shostack on Tuesday April 26, 2016 @05:03PM
(#11575607)
Presumably there's an assumption that they are "taking it seriously" and hardening their systems as a result. While it may not make them any less of a target (indeed, people now know they can be hit, and what NOT to try if they plugged this hole), they hopefully have taken steps to limit the legal, financial, brand and customer fallout.
If you think that is a valid assumption, perhaps this risk is not mitigated entirely, but it would certainly change the risk profile of such a black swan event, would it not?
... or are they? At least, will they have data breaches every few years? What's the annual cost of doing all the work needed to prevent data breaches? If it's less than the averaged-out cost of cleanup, why weren't they doing it all along? If it's more, and they're accepting data breaches as a cost of doing business, shouldn't they be reporting that cost?
And if they don't think it's going to happen again, why not?