Hacker News Reader

Comment by harry8 | Hacker News Reader

Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known.

The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will resign, those who take the job would actually take an interest and have the ability to do so.

An idea whose time has come.

View on HN

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear.

No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against.

There are millions of motivated adversaries out there and a finite number of employees at your company to outsmart them. It's a game you can't win. The larger your company becomes, the broader your attack surface becomes, and the higher value a target you become.

You just have to hope that when you get hacked, it is a "forgiveable" hack like a zero-day or highly targeted attack.

If CSO's are to be personally accountable for the malicious actions of others, it needs to be due to clear negligence on their part and the responsibilities need to be clearly defined.

You're in charge of security at a large e-commerce company, and your view is that your company is bound to get hacked?

I think that's a very sad commentary on how little your company values security.

Our company cares more about security than anyone in our space, if you look at how much we invest relative to the others. We have full time penetration testers on staff. We contract out to countless third party security vendors. We take their advice.

This has nothing to do with not valuing security, it's just about being realistic. Can you guarantee that your company is hacker-proof? No? Then we're on the same page.

I'm not sure why we have to accept a dichotomy between guaranteeing hacker-proofness and throwing up your hands and saying you're bound to get hacked no matter what you do.

It's great that you take all those steps and investment. The fact that you still don't believe you can control whether or not you get hacked is a sad reflection of modern software practices, which are akin to throwing together a house out of plywood, newspaper, and gasoline, then asking the security team to place fire extinguishers.

I don't think your metaphor applies here.

I believe it's more like getting into a car accident. You can be the best driver in the world, you can always drive under the speed limit and take all precautions but you are bound to be in an accident at one point or another.

You may go decades without incident but it's almost a certainty that you will find yourself in a situation where another driver collides with you in a way that couldn't have been forseen. This driver could have hit you accidentally or on purpose, it doesn't matter. You could be teaching another how to drive during the incident, you could have had a momentary lapse in judgment...it doesn't matter. What matters is how you handle the situation after the fact and the steps you took to mitigate the damage.

If you spend enough time on the road the likelihood of an incident approaches 100%.

I think your perspective is either immature or unrealistic.

OP's a realistic. His perspective is nothing to do with how a company values security.

No one in security assumes they won't get hacked, we assume we will and when we do get compromised. Our metrics aren't measured on if, our success metrics are:

* How quickly we find out * How much damage we can mitigate * How quickly we mitigate the risks and controls for X vulnerability and * How we incorporate our reporting to find trends to find the event quicker next time

Now we report on many compromises. I'm not talking just about data breaches here, there's a whole spectrum of compromises that we manage and mitigate.

I don't know anyone who operates in Security who has a different mindset to OP.

Having practices in case for the event of a hack is obviously good, but it doesn't imply believing that you can't control getting hacked and can't win against the hackers (previous poster's exact words).

It's because you can't control it. There are limitless attackers and vectors. Security is mostly a game of being hardened enough to where most of those attackers will give up and go off looking for easier targets. Against a zero-day that nobody knows about yet, or an extremely determined attacker with a lot of patience? You will eventually lose, and you have to do your best to detect when it happens and act accordingly, as stated previously.

> OP's a realistic. His perspective is nothing to do with how a company values security.

Of course it does. The stick is not big enough so CSOs just do not care enough. Increase a size of the stick and it would split the group of CSOs into two:

1. Like OP will run away saying "I'm not going to put myself in a line of fire if crap gets hacked". We need broomsticks for those.

2. The ones that will say "OK, two years", do their best and probably succeed.

More a sad commentary of how many people think there's some magic bullet of security practices and if they just follow those, then they won't be hacked.

If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems.

Otherwise, you'll be like a former coworker that refused to secure internal systems because "We paid a lot of money for our firewall, it's going to block any hackers". It took me less than 30 minutes on my first day to hack the login passwords of senior executives because they logged into a non-SSL reporting server (and I did through a simple MAC overflow attack on a network switch from a network port in the break room)

> If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems.

I see a big difference between preparing for the event of a hack, and believing that a hack is inevitable no matter what practices are in place.

How do you get your CEO to pay for the monitoring and other breach preparation if you've just told him that "We have air-tight security, we cannot get hacked"?

CSO: We have airtight security, we cannot get hacked.

CEO: Great!

CSO: Please approve and fund this plan to handle a breach in case we are hacked.

CEO: But you just told me we can't get hacked.

CSO: Right, it's impossible.

CEO: So why do we need to spend money preparing for it?

CSO: Just in case.

CEO: Just in case what? You just told me it can't happen.

That seems a little like asking for money to prepare for an alien invasion or a zombie attack.

Probably the CEO would have read the document their Insurance Carrier made him sign that details the measures they need to keep cyber cover valid and therefore this conversation wouldn't happen.

You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn't be given a pass on everything either.

So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence?

> A random engineer could make a mistake that gets hackers a step closer

That could be prevented, to a large extent, with much tighter controls. Of course, those controls would greatly increases the cost of operations and other things.

Is it possible we're all accustomed to the wrong model, that our standard of IT security is like the standard of car safety in the early auto industry (and maybe until the 1970s) - far too lenient? Maybe we should be facing the potential fact that the normal cost of IT should include those controls and other security expenses.

> So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence?

By analyzing how they prepared for the inevitable attack (mitigation), as well as how they respond to it after the fact.

(In the EU) companies are already required to tell where my personal data goes to. There is no specific fine for violations as far as I know though.

Essentially we need a price tag on personal data. Let's say 1$ for each email and password leaked to an unknown number of entities. That would be a 114M$ incentive for Uber to keep their data secure.

> There is no specific fine for violations as far as I know though.

It's a shame this happened pre-GDPR because that has steep fines - 4% of worldwide revenue - which would be north of $260M going off their 2015 numbers. And that's assuming they get off with a single fine.

GDPR is pretty much the thing that will - if properly executed - mean the end of these things.

As CEO, former engineer and customer I really hope this gets some serious traction. IMHO if you are making money from customers, it should be mandatory to follow compliance regulations and protect all data.

GDPR will come into effect in about half a year. Everyone is sitting duck about exactly how to implement things. When this gets into effect, companies will take it seriously - the fine is astronomical if you fail.

> You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn't be given a pass on everything either

Sure they can. It is called "insurance". Sort of like malpractice. CSO wants to get paid millions of dollars? Excellent, either be personally on the hook or have an insurance company that would be willing to underwrite your method of dealing with it, be that having your own crack team of people who get to oversee everything, or relying on Jr system admins from your company or whatever else.

I’m not sure the previous comment is saying in all circumstances. I agree with what you’re saying - because higher officials obviously aren’t able to catch every mistake made by every engineer but I think the parent comment really meant that if there is gross negligence or intent to cover up breaches then that seems like a crime that the individual should be punished for.

Not because you got hacked. No. Hell no. I never suggested that and reject it totally.

We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your board of directors.

CSOs, senior management, boards of directors should be personally responsible for their own actions. They need to have something at stake that they really dread losing when making the decision "perhaps we can get away with this?"

The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data?

And how do you make that scale? If I miss a semicolon and leak 5 people's data, then I'd hardly get any jail time. If I miss a semicolon and leak 150,000,000 people's data, I will die in prison. In both scenarios, I made the same error, but the outcomes were insanely different!

The law as plenty of experience dealing with sufficient nuance to distinguish a mistake from negligence.

Covering up isn't done by the CSO. It'll be driven by lawyers, or worst-case by a rogue CEO. Mind you the CSO would be expected to resign under those circumstances, if they were kept in the loop on the cover up plan.

IANAL but isn't it already the case that if you knowingly break a law, you can be convicted and sentenced to jail? In this case, I'm assuming that it's not against the law to cover up a hacking incident, in which case there's no basis to suggest putting someone in jail.

It's not really much about that Uber got hacked, which is bad enough. It's that they paid off the hackers and didn't tell anyone they got hacked until now.

If you can demonstrate due process and reasonable effort to secure against breaches, your doing your job. For instance with described procedures, sane defaults, locked down environments ect. But if you're a CSO and have not described threatmodels, workflows, and security practices, then you've not done your job and should be held accountable for data breaches.

There is personal liability for board members and management boards (CEO etc.) in many (most?) jurisdictions, usually including for some things that they should have known but didn't know, typically if the "not knowing" part can be characterized as gross negligent.

Also, the personal liability for board members and managers is something that is exceedingly pursued by shareholders and creditors (for the financial liability) and prosecutors (for the criminal liability) compared to how it used to be.

I don't think it matters much, though.

How to implement though?

You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats. Also never underestimate just how disorganised large organisations are, incompetence at addressing issues is systemic and goes far beyond data protection. What seems like malice is sometimes just plain stupidity.

It has to be backed by some sort of regulatory framework. Just like a fire code or employment rights. But crafted in a way that it doesnt end up like PCI, ratings agencies or financial auditors. IE creating an industry that sells compliance and not actual security.

Perhaps something light, like mandetory minimum bug-bounty schemes for all companies, where fines (or more) are imposed for not addressing issues and an independant regulator works with larger companies to resolve issues (or penalise the company severely if they deliberately wont).

No, don't get hung up on unnecessary details.

The reasonable company director should have known X and when found out was bound to report it. Person Y did not report it, should have known as it was their job to know and there aren't extenuating circumstances. Guilty. 6 months. Next case.

"I don't know anything about this company I accept 7 figure sums to oversee as a director." Should never be any kind of legal defence. If senior management and directors have something personally at risk you'll see vastly improved behavior. Right now we're selecting for the opposite and seeing the inevitable results.

There is a story like this about directors and management cover ups every single day

So person Y read an email late at night and forgot about it. So you send a director to jail. Tomorrow many of the "good" directors feel scared and they simply do not accept any new appointments.

Who will fill the void ? People who are overconfident and people who are not scared of going to jail.

It's much better to impose financial penalties. Should the directors or the shareholders pay ? Let them figure it out between themselves!

> So person Y read an email late at night and forgot about it. So you send a director to jail

We do this for CFOs, Chief Compliance Officers and many other roles for many other things.

Doesn't PCI work well in general? It has a large amount of overhead but we see very few credit card breaches from within the "PCI vault," while we see many Social Security number breaches and email/password combinations.

For example, the Target credit card breach occurred because malware intercepted the credit card information at the Point of Sale appliances before the information was encrypted and transmitted.

Prison time seems extreme, but Congress should should absolutely establish statutory fines (for companies) for breaches of PII. Then any company officer can save the company money by simply spending more on prevention because it will lower breach insurance premiums.

You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats.

WEll that's already happening without jail time so maybe give it a whirl. LEt's get real here, the idea of suits going to jail is just scary to some people but it'll be fine.

What's the largest group of people you've managed?

Reply on news.ycombinator.com