Hacker News Reader

Comment by SavantIdiot | Hacker News Reader

More like they wanted to avoid mob panic. If the corporation was hacked and kept it on the DL, but boosted security posture in response, is that a bad thing? If they were hacked and did nothing, well, screw them. Perhaps the SEC should couch the expectations with a bit of reassurance.

View on HN

> If the corporation was hacked and kept it on the DL, but boosted security posture in response, is that a bad thing?

If it's a public company, it's securities fraud. IMHO, securities law is the most effective tool at the moment in encouraging improved security engineering, best practices, and posture.

https://www.sec.gov/news/press-release/2021-154

""As the order finds, Pearson opted not to disclose this breach to investors until it was contacted by the media, and even then Pearson understated the nature and scope of the incident, and overstated the company's data protections," said Kristina Littman, Chief of the SEC Enforcement Division's Cyber Unit. "As public companies face the growing threat of cyber intrusions, they must provide accurate information to investors about material cyber incidents."

The SEC's order found that Pearson violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 and Section 13(a) of the Exchange Act of 1934 and Rules 12b-20, 13a-15(a), and 13a-16 thereunder. Without admitting or denying the SEC's findings, Pearson agreed to cease and desist from committing violations of these provisions and to pay a $1 million civil penalty."

If what's being disclosed is of the nature of the Pearson hack (theft of student records) then great. But there are probably thousands of hacks that don't result in the disclosure of PII or other confidential information.

I can understand companies being worried that a compromise of a test system with no access to sensitive data -- which they normally wouldn't be required to disclose -- could make them look bad. But at the same time they're all being required to disclose this info so at least there's safety in numbers.

I agree that a breach of a test system with no access to sensitive information or digital property (information, source code, binaries, etc) and no ability to pivot from said test system to other systems should not require reporting. To pick an example, that's not what's happening with S3 buckets and Mongo instances (where vast amounts of personal and or sensitive information is being leaked). That's not what happened with Equifax, T-Mobile, Solarwinds, Colonial Pipeline, Pearson, CNA Insurance, etc. You have to hold the feet of these businesses to the fire, and if they don't perform, dissolve them after repeated regulatory failures (just as Arthur Andersen had happen after Enron's failure, or FDIC would part out a bank after insolvency).

https://www.reuters.com/technology/hackers-demand-70-million... (July 2021: Up to 1,500 businesses affected by ransomware attack, U.S. firm's CEO says)

(disclosure: infosec practitioner)

I think how and why the breach occurred matters more than what information was accessed. In asset management, for example, when you’re dealing with an error you don’t just look at the dollar amount. Maybe the error only cost a couple thousand dollars today (or maybe it even made money!) but the exact same error on another trading day could just have easily been ten, or a hundred, or even a thousand times more costly. That the error happened at all is the material event. And that’s why there’s no such thing as a de minimus trading error. Sometimes you just get lucky in the magnitude of the impact. Even if it didn’t cost you anything you still need to address the weak point that allowed the error to happen in the first place.

So even if a system with absolutely no information was breached if your other system(s) use(s) the same or similar security then it doesn’t really matter that nothing was taken. The breach could still material (and require disclosure) because it’s exposed a material security vulnerability.

Lots of nuance that can’t fit into a single thread.

"If it's a public company, it's securities fraud. IMHO, securities law is the most effective tool at the moment in encouraging improved security engineering, best practices, and posture."

That's just a fucking sad state of affairs. Apparently they owe nothing to their customers.

They are contemptuous of customers, viewing them simply as dumb cattle to be manipulated.

> If the corporation was hacked and kept it on the DL, but boosted security posture in response, is that a bad thing?

A public corporation has a legal and fiduciary duty to its owners other than hiding what happened.

Reply on news.ycombinator.com