The Mirai Botnet Is Proof the Security Industry Is Broken

Re:The Mirai Botnet Is Proof the Security Industry Is Broken by pjmorris on Tuesday November 01, 2016 @03:37PM (#12849358)

Seems to me that the core of insurance is actuarial analysis of the potential risks and costs... and I don't think anyone has a good model or good data for when and why security problems occur. For the time being (and perhaps for the rest of time) we need a security crash reporting agency, analogous to a transportation crash reporting agency, e.g. the US NTSB. Getting standard reporting on security breaches might be a good start. I think the National Vulnerability Database [0] is honorable and well-intended, but the reporting there is uneven.

[0] https://nvd.nist.gov/

[ Parent | on HN ]

Re:The Mirai Botnet Is Proof the Security Industry Is Broken by ethbro on Tuesday November 01, 2016 @05:52PM (#12850367)

This. We model death rates somewhat accurately. Health care costs somewhat less so. Macro financial systems somewhat less so. I'd put "assign risk to a moderate sized enterprise's network of data systems" at more complex than all of those.

[ Parent | on HN ]