Honestly, I'm more afraid of reputational loss than government fines. Our customers don't have to use our product. They do because they trust us. Lose that trust and it's awfully hard to get it back.
There are so many alternatives to what GoDaddy provides, it is quite commoditized.
But also... true, their customers don't seem to care anyway? Or it's "cost of switch", even just mentally? If you were starting fresh it really wouldn't be any harder at all to go with any of numerous alternatives, but if you already have godaddy...
EDR (especially Windows EDR) is heavily commodified.
Did you move to a new bank after yours had a security breach?
There are so many breaches these days, companies don’t even have liability — any damages can be blamed on another breach.
Worse. It's a market where most of the customers are unsophisticated but price sensitive, so they tend to prefer the provider with the lowest apparent price, and then the big providers compete on the basis of who can present the lowest apparent price through the use of dark patters, misleading claims, bait and switch tactics and hidden fees.
Example: GoDaddy provides a "free" site builder but if you use it the resulting site can't easily be extricated from their service and now you're locked in if you don't want to recreate your site. Meanwhile the price you were quoted for various services was an onboarding price and now that you've sunk a lot of time creating and improving the site you can't move, the price is going up.
This is, incidentally, a major reason WordPress is so popular despite being fairly miserable. It makes it easy for unsophisticated users to get started and your site isn't tied to a particular host.
A couple of days of production stopped can cost a lot of money.
it takes time there are plenty of lawsuits flying around that incident .
Even if they win all the suits without settling or loosing, customers will negotiate far stiffer penalties and controls on next renewal or get steep discounts or just straight up switch vendors .
Sooner or later their ability to be competitive will get affected and they will likely become a target for acquisition and rebranding.
Organizations of that magnitude do not collapse overnight like startups
switching from godaddy to another registrar is not super hard, but there are hurdles and sometimes problems occur that even people with experience run into.
I think (some?) people also hope a place that suffers a breach learns from it and makes it near impossible for similar to happen again.
The only people who's reputation gets ruined are the D-Level Directors and Managers who run this stuff and regularly run into budget or resource shortfalls that prevent them from doing all that they are capable of doing.
but do I blame the average person for not caring? The kind of person who would use GoDaddy for hosting? I find it really hard to blame them.
Yes, the CRWD ticker took a hard hit, dropping about 50% over the course of 2 weeks last July. But... it recently topped its previous high, only 7 months later (which is like 1/2 or 1/3 of an enterprise sales cycle!).
Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected.
We get training on it every six months.
I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues..
looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.
There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house security staff, these types of offerings can be quite helpful.
For a more grounds-up approach, there are guidelines such as the NIST SP 800-50 "Building a Cybersecurity and Privacy Learning Program" guidance. (https://csrc.nist.gov/pubs/sp/800/50/r1/final)
If you have specific questions, I can try to answer them.
And, from my experience, many of the trainings that seem almost offensively easy to me (e.g. "How to read a URL") have been some of the ones that received the most positive feedback from non-technical departments.
The real key with security awareness training is ensuring the training is at the appropriate level of complexity for the trainee.
Appreciate you and @ziddoap offering insight!
Looking at starting deck for FTC issues, Hipaa issues, and Google's policies - all for websites and apps specifically very soon and let the videos / webinars / interactive / discussions grow from here.
Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"
It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name.
Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure
If the outcome of ignoring data security is to not make any money then companies will actually do something about it.
Penalities should push the company to the point of failing.
You phrasing it like this is not a substitute for explaining why it wouldn't be those things.
Also, the most obvious thing is: if you're a healthcare provider, you would probably hire some hackers to go after your competition, and let heavy-handed fines take them down. Much easier than providing better value.
I got a letter telling me they gave away my information with a link to an “identity monitoring” site that looks like the CEOs nephew built in a weekend and just errors out when I sign up.
Even better, the consequences are stronger in the event that the company obviously wasn't giving a fuck about security.
I wish we had HIPAA for all PII.
And people wonder why Luigi is seen by some as "the good guy".
It's free internet points, I guess, but it's also not constructive and frankly more than a little bit creepy.
What makes you think it's not constructive?!
I think it's worth discussing why a large number (possibly even a majority!) of people want to murder executives. Telling those people to shut up removes yet another way for them to express their opinions. I think taking notice of the room is very constructive. I think having a point to discuss (even if it's violence) is constructive. Talk is cheap, after all; and talk is way cheaper than murder.
Moreover, I've heard many many many people insist that violence is never the answer. Alas, they forget that violence is how most countries were founded; ignore that many laws and regulations are written in blood; and rarely consider the situations where all other solutions have been explored and exhausted. Further, if business is so worried about costs, and violence can be cheaper than exploring all alternative options, then there's definitely a business mindset to that. And business is what you want to discuss anyway, right?
If you really think violence is never the answer then you should do everything in your power to prevent it. So instead of insulting someone for expressing an opinion, perhaps you should talk to them instead. You might discover a new/unique point of view, or you might even be able to change their mind.
Because it's completely and totally irrelevant to the topic at hand, the only connection is the general strata of the position that the people held—not even the same title, just the same class of title!
I'm generally not okay with people calling for murdering people based solely on their job title. Subtly hinting that it might be okay to kill those people is not much better.
> So instead of insulting someone for expressing an opinion, perhaps you should talk to them instead.
They didn't express an opinion, they casually referenced a mostly unrelated sensational story while intentionally avoiding expressing an opinion.
Fun fact: topics can change while discussion continues.
> I'm generally not okay with people calling for murdering people based solely on their job title. Subtly hinting that it might be okay to kill those people is not much better.
To be clear, neither am I. But I do think it's important to discuss with people who think it is okay because, as I said earlier, telling them to shut up will result in worse situations.
> They didn't express an opinion
Perhaps the mere fact that you don't recognize their comment as an opinion is partly why people feel unheard.
That doesn't make it reasonable to insert a casual call for murder into every loosely related conversation [0].
There are many reasons to explain why people wonder. No one single reason is enough to explain it.
Luckily, no penalty for breaches can be resolved with laws and/or regulations. I suggest you take this matter up with your lawmakers instead of making comments which incite those very same people you describe.
As SRE, I've heard executives say this "There is no penalty for breaches, why care?"