Hacker News Reader

Comment by stcredzero | Hacker News Reader

The CTO/CIO and the person immediately below them (and the person immediately below them) are the "buck stops here" people for these kinds of issues, but often are either one of two types. 1) Too much MBA, not enough tech. 2) Too much tech, not enough MBA.

1) Knows how to get people to do things, but doesn't know what needs to be done.

2) Knows exactly what would fix security, but doesn't know how to get people to do those things.

View on HN

1) Has been told what needs to be done and decided to nix the idea because security is a cost center that cuts into their bonus potential.

Eh, while this happens its getting rarer and rarer. Execs know that if a cybersecurity issue is brought to them they kinda have to take it seriously (in 2020 anyways) or be the next Experian.

Edit: whoops Equifax, not Experian

What exactly happened to Experian? Their stock is up almost 100% since the breach announcement, and no one went to jail. If I were an executive looking to Experian as an example I would conclude that the market as a whole does not care about security.

Experian is a pretty unique case, because the people whose data they lost (you and I) don't have a choice to not do business with them. And the people who actually do have a choice (businesses) realistically don't have a choice either.

It was Equifax that had the data breach, not Experian. Equifax was fined $700 million. Experian benefitted from the breach though since Equifax provided Experian credit monitoring services to those whose data was released.

Equifax stock has gone up since the 2017 data breach, though because consumers are not customers of Equifax, it's banks and lenders who are not concerned with data they don't control. If hackers had broke into Equifax and changed people's credit scores, the banks might have been a bit more concerned.

>Equifax was fined $700 million.

The equivalent of a regular person having to give up the coins they found in their couch cushions.

Well, risk being the next Equifax, not necessarily BE the next Equifax.

If taking on that risk gives someone a 90% chance at a massive comp boost and a 10% chance at a more negative outcome where they're likely still well compensated, many execs would consider that.

Reply on news.ycombinator.com