Advanced Persistent Threat Compromise of Government Agencies

Re:Advanced Persistent Threat Compromise of Government Agencies by Karunamon on Thursday December 17, 2020 @06:35PM (#25461934)

Why wouldn't increased penalties for failure do it? We're in an environment where spending money on better security and preparing is seen as waste. If the alternative is having a large fraction of your profits confiscated because you were being negligent, that seems like the most direct way to address the mindset at the organization level.

If investors ask why you're spending so much on ITSEC, you point at regulatory requirements.

[ Parent | on HN ]

Re:Advanced Persistent Threat Compromise of Government Agencies by skybrian on Thursday December 17, 2020 @07:48PM (#25462473)

Someone has to point out the possibility of failure to someone who can do something about it. Where is the incentive to point it out or spend time looking for failures? Particularly when it's not their job? You need to make it someone's job.

In some cases, insurance can do it. It's the insurance company's job to understand and minimize risk.

But the best idea I've read is to have a regulatory agency like the NTSB.

[ Parent | on HN ]