Re:533M Facebook users' phone numbers and personal data have...
by hunter-gatherer on Saturday April 03, 2021 @06:00PM
(#26685122)
This is just it. I also work in the security industry, and the fact of the matter is that we (security professionals) can't give guarantees. I don't know what exotic exploit or bug will exist tomorrow. Security professions basically offer what (to me) seems like a crappy insurance policy. Depending on your orgs threat model, it is often just cheaper to deal with the breaches. --- I am not saying facebook falls into this category. ---
[ Parent
| on HN ]
Re:533M Facebook users' phone numbers and personal data have...
by anticristi on Sunday April 11, 2021 @02:41PM
(#26772447)
Security is not a replacement for a data breach insurance. Security is basic hygiene for insurance to work at all.
To me, a good parallel is home insurance. If you get robbed, a good insurance will cover your losses. However, if said insurance determines that you were negligent -- say you never lock your front door -- you are on your own.
Do you have precious art at home that you want insured? No problem. Just make sure you add an alarm and sprinklers.
That is how I want discussions around security to be held. Are you a start-up with 10 users? It's okay to do minimal security. Are you a bank whose wires carry $1B? Make sure you throw sufficient "bodies" at the problem, from the top of the hierarchy to bottom.