Comment by cmehdy | Hacker News Reader

Comment by cmehdy | Hacker News Reader

"security proponents will probably have to demonstrate improvements to the bottom line: less maintenance, improved customer satisfaction, or other measurable incentives to bring everyone on board"

In most fields there is little incentive to change things when the company itself isn't too affected in case of hack. Stocks go down for a week, then back up. General population doesn't seem to care enough to stop using the services, and does not understand enough about privacy/value of their data/need for encryption. So why would a company care ?

If being "ethical" and more devoted to privacy becomes a trend, perhaps there will be a stronger drive to follow security experts' advice. Did Whatsapp get a surge in users after enabling end-to-end encryption?

https://hbr.org/2015/03/why-data-breaches-dont-hurt-stock-pr...

>In most fields there is little incentive to change things when the company itself isn't too affected in case of hack

This is correct. As long as the risk isn't too high then companies will just take the risk and accept a hack as the "cost of doing business". Much like Goldman Sachs expects they will get fined by Governments, but they don't care because the money they make far outweighs the fines imposed.

New legislation, fines against businesses form a feedback cycle. They keep going up against repeat offenders until the behavior changes. Inverse exponential-backoff under collision with the regulatory body.

Haha awesome, determine fines with a PID-controller

> In most fields there is little incentive to change things when the company itself isn't too affected in case of hack.

This is steadily changing. I've had a few recent engagements where i've been asked to evaluate the security practices of potential partners and suppliers and in one case the result affected a sourcing decision.

I can see this becoming more common, which could eventuate into a credit-reporting like bureau setup to audit security and privacy practices.

The EU will soon have fines for data protection violations. Up to €20m

https://www.out-law.com/en/articles/2016/may/gdpr-potential-...

That fine seems low, preserving the moral hazard, unless it applies to each affected person or some other compounding factor.

€20m buys you a lot of infosec.

Reply on news.ycombinator.com