Or are they trying to adjust, and the attacks are getting so sophisticated that the pace of investment in counter-measures is below that of the pace of advancement in the complexity of attacks?
Or something in the middle?
Of course, this model assumes that as soon as you have penetrated the perimeter, the rest becomes easy. This is the more traditional model. People are increasingly adopting a you-are-already-hacked approach, which makes it harder to move laterally once someone gets in. However, the general challenge still applies.
Once you understand how difficult attack mitigation is, then you can pick and choose from a variety of factors:
- executives may not have a realistic understanding of how difficult attack mitigation is so they don’t allocate the resources for hiring
- incompetent admins overestimating their abilities
- competent admins who are underfunded
- incompetent admins who underestimate the value of the data they’re protecting
- competetent admins who may not have an accurate picture of what data they’re trying to protect so their threat model is flawed due to inaccurate information
- executives who are aware of how difficult mitigation is but don’t place customer data privacy as a priority.
- the current iteration of our growth obsessed corporate models unintentionally results in a race to the bottom in many ways.
- little incentive for companies to factor in social impacts as we don’t yet seem inclined to figure out a way to include impacts on society as one of the many metrics to measure a company’s success or failures.
It’s worth remembering though, even the most responsible, most well funded, most security conscious, and best staffed organizations have been compromised at one point or another—security is hard.
Offense needs only one hole, whereas defense needs to plug all, including human behaviors. When the offensive side finds a new attack, they can often try and see which of the victim is vulnerable, thus the offense can pick and choose among many potential victims, whereas the defensive side needs to defend from all attackers. The information, once leaked, can't be recovered - i.e. once exploit is successful, there's no "recovery" available.
All of those factors combined make defense orders of magnitude more difficult - in terms of careful attention to detail, in terms of manpower, in terms of human training and vigilance, etc. For those reasons, the best defensive strategy is to minimize the information you need to protect.
It’s not really a security issue as much as an incentive issue.
Luckily you can sign up for Quora with any name and email. You have to assume that no matter how hard a site tries to protect your info, it will get compromised sooner or later. The best they can do is what Quora does: demand as little info about you as they need.
In addition to that, attackers only have to get lucky once, the defenders have to check every entryway.