Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by rocqua on Tuesday November 01, 2016 @06:45PM
(#12850798)
> Premiums go down the more secure your site
That shit will bring out the snake-oil men harder than anything. It means those peeps will do all they can to get the auditors to think you are more secure.
Instead, have a requirement of some compliance, with penalties for breaking compliance.
Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by badloginagain on Wednesday November 02, 2016 @02:52PM
(#12858044)
Honus is on the auditors to know what works and what doesn't. Auditors tell you "these are the things you must do to be compliant". Then the oilmen have to sell to people who lose money if they're wrong.
Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by rocqua on Thursday November 03, 2016 @07:11PM
(#12868932)
Ticking boxes helps with security, but it tends to be easy to tick the box and yet mitigate much of the actual benefits. When this is cheaper, some companies will chose it, and snake-oil-salesmen will help them do that.
You need some kind of incentive that derives directly from the end goal (less breaches), rather than some derivative (better standards compliance). Auditors certainly have their place, but we need more than them.
edit: Also, you probably meant 'onus' rather than 'honus'.
Like you, I have no idea what I'm talking about, but as OP demonstrated you can do everything right and get unlucky, or do nothing right and get lucky. Sounds perfect for some kind of insurance scheme.