Hacker News Reader

Comment by stackskipton | Hacker News Reader

>If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this one occur)

As SRE, I've heard executives say this "There is no penalty for breaches, why care?"

View on HN

As SRE, I've heard executives say this "There is no penalty for breaches, why care?"

Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected.

We get training on it every six months.

I'd like to hear more about this training -

I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues..

looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.

Not the person you are replying to, but I work in security and have spent ~5 years of my career helping various companies set up and maintain security awareness programs.

There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house security staff, these types of offerings can be quite helpful.

For a more grounds-up approach, there are guidelines such as the NIST SP 800-50 "Building a Cybersecurity and Privacy Learning Program" guidance. (https://csrc.nist.gov/pubs/sp/800/50/r1/final)

If you have specific questions, I can try to answer them.

As a technically-minded person, I've found both KnowBe4 and ProofPoint trainings to be very lacking/boring/superficial.

While I agree with you, that's why they are a starting point for someone looking to stand up a program, not an end point.

And, from my experience, many of the trainings that seem almost offensively easy to me (e.g. "How to read a URL") have been some of the ones that received the most positive feedback from non-technical departments.

The real key with security awareness training is ensuring the training is at the appropriate level of complexity for the trainee.

One way to relieve the boredom is to count the number of times you see the people in videos typing away on desktops/monitors with no cables plugged into them.

KnowBe4 is awesome. It trains everyone to be on the lookout. The penalty for barely screwing up is another boring training session that no one has time for. Very painful. Pain is a great teacher.

Very glad to these options and how they can be perceived by people, this should mean there are paths and that if they can be made better / different for different audiences that they may be well received.

Appreciate you and @ziddoap offering insight!

Looking at starting deck for FTC issues, Hipaa issues, and Google's policies - all for websites and apps specifically very soon and let the videos / webinars / interactive / discussions grow from here.

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data

Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"

Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.

You have to provide your email to sign up for HN, however, it is not publicly visible. If YCombinator had to pay $10,000 for leaking a user email, this site isn't going to exist since it's not their core business and represents a huge liability.

It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name.

Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure

Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers).

If the outcome of ignoring data security is to not make any money then companies will actually do something about it.

Penalities should push the company to the point of failing.

> Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"

You phrasing it like this is not a substitute for explaining why it wouldn't be those things.

Also, the most obvious thing is: if you're a healthcare provider, you would probably hire some hackers to go after your competition, and let heavy-handed fines take them down. Much easier than providing better value.

Wouldn't that strongly incentivize companies to secure their data better, thereby achieving the goal?

It might achieve that goal, at the too-high expense of other things.

Then I (a normal user) find myself in the position of my data being stolen/mishandled AND have to either pay for it via increase fees, or my healthcare provider goes belly-up and I have to find a new one.

Except Change Healthcare got hacked, lost a ton of records and they are still operating. So those fines must be, could be up to xx,000 per person affected but in actuality, those affected will get Arbys coupon and C Suite will lose a week of yacht time.

Not even that. You always have insurance for this stuff.

But then the insurance company has to pay, and they'll work hard to make sure it doesn't happen. This doesn't sound like an explanation to me.

You don't really have a choice, you have to have insurance for breaches (HIPAA term, not strictly the typical cybersec term, means any loss of control of information that results in potential of dissemination of PII).

I didn’t even get an Arby’s coupon.

I got a letter telling me they gave away my information with a link to an “identity monitoring” site that looks like the CEOs nephew built in a weekend and just errors out when I sign up.

I'd honestly prefer an Arby's coupon or perhaps a crisp $1 note over "1 year subscription to our credit monitoring service"

Yeah I got those trainings when I was merely healthcare adjacent adjacent adjacent.

It turns out HIPAA is a pretty good incentive to do the right thing, and the key difference is that there are actual consequences for violating HIPAA.

Even better, the consequences are stronger in the event that the company obviously wasn't giving a fuck about security.

I wish we had HIPAA for all PII.

But it does slow things down. Startups don't want to deal with that stuff. So they'd have to outsource it. I'm not sure how.

> As SRE, I've heard executives say this "There is no penalty for breaches, why care?"

Honestly, I'm more afraid of reputational loss than government fines. Our customers don't have to use our product. They do because they trust us. Lose that trust and it's awfully hard to get it back.

Crowdstrike took down all windows boxes that had their software installed and didn’t really affect them.

I think customers feel, rightly or wrongly, there's no alternative to CrowdStrike.

There are so many alternatives to what GoDaddy provides, it is quite commoditized.

But also... true, their customers don't seem to care anyway? Or it's "cost of switch", even just mentally? If you were starting fresh it really wouldn't be any harder at all to go with any of numerous alternatives, but if you already have godaddy...

I've actually not worked anywhere that has used CrowdStrike. It's usually ruled out as too expensive (I've mostly worked in public sector). I've had very good experiences with Sentinel One and Microsoft Defender. I've had terrible experiences with Trellix and Sophos."Oopsy" aside, is CrowdStrike really that much better than the competition?

The big four (CRWD, S1, Prisma, and MDE) all mostly comparable tbh.

EDR (especially Windows EDR) is heavily commodified.

A commodified market with no good product? Something is wrong here.

It's enterprise software. The people using the software and the people choosing the software are not the same people. In many cases they only buy it to satisfy a contractual or regulatory requirement and then the primary criterion is which one costs less or which one's sales reps give the best kickbacks, with considerations like "is it any good" not really playing a major role.

Race to the bottom.

I only worked at one shop that used CrowdStrike but TBH compared to the others I've had to deal with, definitely is the 'least' shitty compared to other competitors...

I always feel dumb and like I'm missing some fundamental principle thinking about companies like GoDaddy. They provide a pretty undifferentiated commodity with a relatively low bar to switching, don't seem particularly well run or trustworthy based among other things on events like this, and their brand and marketing give off a vaguely skeezy low-rent vibe. Is it just a perpetual motion machine of market sharing affording good marketing which then drives continued market share?

Are banks not fairly commodified too?

Did you move to a new bank after yours had a security breach?

There are so many breaches these days, companies don’t even have liability — any damages can be blamed on another breach.

Not commodified as much as regulated. The personal data that banks collect is probably mandated by the government, so switching banks doesn't really change the risk someone faces. And probably a bunch of other things that would otherwise be competitive advantages for customers too. The lack of full reserve banks (or close enough too) despite what would be a reasonable level of customer demand, for example.

> Is it just a perpetual motion machine of market sharing affording good marketing which then drives continued market share?

Worse. It's a market where most of the customers are unsophisticated but price sensitive, so they tend to prefer the provider with the lowest apparent price, and then the big providers compete on the basis of who can present the lowest apparent price through the use of dark patters, misleading claims, bait and switch tactics and hidden fees.

Example: GoDaddy provides a "free" site builder but if you use it the resulting site can't easily be extricated from their service and now you're locked in if you don't want to recreate your site. Meanwhile the price you were quoted for various services was an onboarding price and now that you've sunk a lot of time creating and improving the site you can't move, the price is going up.

This is, incidentally, a major reason WordPress is so popular despite being fairly miserable. It makes it easy for unsophisticated users to get started and your site isn't tied to a particular host.

Crowdstrike's security reputation matters a lot more. I'll bet the customers assume the competitors have the same reliability problems, they can tolerate a little downtime, and going with nobody is even worse.

> they can tolerate a little downtime

A couple of days of production stopped can cost a lot of money.

Yet.

it takes time there are plenty of lawsuits flying around that incident .

Even if they win all the suits without settling or loosing, customers will negotiate far stiffer penalties and controls on next renewal or get steep discounts or just straight up switch vendors .

Sooner or later their ability to be competitive will get affected and they will likely become a target for acquisition and rebranding.

Organizations of that magnitude do not collapse overnight like startups

I’ve been around long enough to see this not happen. Crowdstrike ticks a lot of boxes and no one buys them for anything else.

I feel this is more important for a younger or smaller company, and less so when stopping a product from one company to switch to another is a pain in the ass or has other problems / risks..

switching from godaddy to another registrar is not super hard, but there are hurdles and sometimes problems occur that even people with experience run into.

I think (some?) people also hope a place that suffers a breach learns from it and makes it near impossible for similar to happen again.

Most customers use your product because it was on the first page of their Google search results.

The only people who's reputation gets ruined are the D-Level Directors and Managers who run this stuff and regularly run into budget or resource shortfalls that prevent them from doing all that they are capable of doing.

The whole thread is related to GoDaddy's numerous breaches not affecting their bottom line or market position. So it seems lots and lots and lots of people really don't care.

I can take my business elsewhere and do.

but do I blame the average person for not caring? The kind of person who would use GoDaddy for hosting? I find it really hard to blame them.

Also your data will probably just be leaked somewhere else sometime anyway. Punishing a single company once unfortunately does next to nothing at this point.

Creating lock-in which prevents customers from having an alternative is a more effective use of money, because it "solves" not just the threat of reputation loss due to security failures, but many others at the same time.

Many people consider building a business on customer trust to be a strategic mistake.

That reputational loss is almost exclusively among those who understand how the crowdstrike products work, but the Venn diagram with those folks and “people at companies who can approve large expenses” is nearly empty.

Yes, the CRWD ticker took a hard hit, dropping about 50% over the course of 2 weeks last July. But... it recently topped its previous high, only 7 months later (which is like 1/2 or 1/3 of an enterprise sales cycle!).

We’Ve eVaLuaTeD the RisKs

Reply on news.ycombinator.com