Hacker News Reader

Comment by skybrian | Hacker News Reader

What does it mean to "hold orgs to account?" Let's unpack this.

When some organization promises to do a thing and they fail to do the thing, then sure, you can blame them for breaking their promise.

This doesn't fix anything though.

To fix things you need to talk about preparedness. Whose job is it to prepare? Do they know what to do? Do they have the resources to do it?

Increased penalties for failure aren't going to fix it. And especially, deciding afterwards that someone should have known it's their problem isn't going to fix it.

View on HN

Why wouldn't increased penalties for failure do it? We're in an environment where spending money on better security and preparing is seen as waste. If the alternative is having a large fraction of your profits confiscated because you were being negligent, that seems like the most direct way to address the mindset at the organization level.

If investors ask why you're spending so much on ITSEC, you point at regulatory requirements.

Someone has to point out the possibility of failure to someone who can do something about it. Where is the incentive to point it out or spend time looking for failures? Particularly when it's not their job? You need to make it someone's job.

In some cases, insurance can do it. It's the insurance company's job to understand and minimize risk.

But the best idea I've read is to have a regulatory agency like the NTSB.

I agree on all fronts. Preparedness is the clearest way. But our economy (and capitalism in general) don't reward preparedness, in fact they often punish for it. I read some article about how building slack into systems is equal to building resiliency into them. How can we build an economy that aligns incentives to be resilient?

The same applies to pandemic preparedness. There is no incentive for a hospital to over-provision beds that are empty most of the time.

Looking for examples of cultures and organizations that over-provision, the military might be an example. Why do we translate worry about physical attacks into action but not cyber attacks or environmental harm?

Because we have had millennia to observe the effects of physical attacks, but the other 2 are much more recent? We haven't yet learnt the hard way.

The underwriting of business ventures goes back at least three centuries, and the market process aligns incentives pretty well. But if you think you can price over/under-preparedness better, that sounds like a profit opportunity for you.

> Let's unpack this.

It's probably a fallacy to assume this can be fully digested in a public forum. Things like this require committees and trust and understanding of the problem. Software threw all that out the window years ago.

We can just pray the AI will know better.

Reply on news.ycombinator.com