Comment by PeterisP | Hacker News Reader

Comment by PeterisP | Hacker News Reader

Parent Full thread

It's worth to note that from the perspective of the involved companies all this incident was much ado about nothing and no incentive to change anything.

Sure, some of their customers or customers' customers got exposed to attackers, and some government secrets may have been lost, and some of their tech employees had to do a bit of overtime and "reputation was harmed", but so what, why should they care? Is there any material impact on the company finances? Currently it does not seem that it's going to destroy their future sales and ongoing licencing revenue, and it does not seem that they are going to have any huge liabilities for negligence.

If anything, the consequences (or lack of them) to SolarWind and other historical breaches are a good illustration that in the current business environment intentionally cutting corners on security is a smart move as it saves you money but if you get used to harm many others then you just shrug, do some apologetic PR and move on, and the impact of reputation damage is small and fleeting.

I've started realizing this since the Exquifax breach. There is no point for companies to take security seriously because what the flip does it matter for them? They'll bohoo about how bad it was, fire their security people bring in new ones and nothing will change.

In short if you are in the security field at this point you aren't being brought in to secure or stop anything you're there for upper management to point the blame at when the attack does occur. Because spending money on security cuts into revenue and profits and unlike not investing in paying off technical debt this has no material consequences.

That's why I bought EFX stock on the dip after the hack, I knew there would be no consequence to their business. I've made 60% off of that bet, beating the S&P 500 over the same time frame.

This comment is a fantastic window into just how distorted the world has become.

(No shade being thrown; good on you for recognizing the opportunity and acting on it)

Tangent: I've noticed very few people are able to separate personal positions from personal insights. Refreshing to see your insight and "no shade" acknowledgement here.

And today $SWI is still just barely under their IPO price, and not even at an all-time low.

This is part of why I love working in the Bitcoin industry. Security there actually matters in a tangible way. Slipping on security can result in irreversible monetary theft of epic proportions. Potentially losing other peoples’ money is much higher stakes than losing their magic social security number.

Security deficiencies are technical debt

They are technical debt with no monetary impact however. If my servers crash and I have downtime because customers can't use my website or product that's a problem. If I suffer a massive security breach and loose all of my customers personal information, I am not going to face any consequences.

Except for customers that drop you, eg, Target.

That's the whole point - if we look at the consequences of historical major breaches, they generally don't result in large number of customers actually leaving the company.

And on some level that's even appropriate as generally the whole industry is vulnerable, it's reasonable to expect that the competitors have just as bad security as the breached company, they just didn't get breached because they weren't targeted by this particular attacker or because their breaches aren't (yet) detected or because they managed to hide and not publicize that breach.

The 2013 data breach at Target is a good example of the worst case scenario because it was the first major widely publicised case, all the newer ones had far less effect because people start to understand that the breached company is not unique (like they thought in 2013 about Target) and even then they lost just ~2.5% of customers, and regained the customer confidence after 2-3 quarters. So even in the worst case scenario, 97.5% customers won't drop you, and any effect is short term, as the Target case demonstrates.

Also, with tech companies... growth is such a huge part of valuation and business plan that they will focus on acquiring new customers rather than retaining existing ones. If you are growing 5-10% quarter over quarter, loosing the 2.5% isn't really going to hurt that bad. It also is easy to explain churn if you have a breach, the board will go "oh, that makes sense" and move on.

Have you heard of ransomware? Expired certificates? DDoS?

This is the IT world's version of too big to fail. If it happened to our smallcap company I'm almost certain we'd lose all our government contracts overnight.

Reply on news.ycombinator.com