251
Why the ‘mother of all breaches’ is a wake up call for everyone
(www.itpro.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 23 Jan 2024
251 points (93.4% liked)
Technology
59590 readers
2888 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
I have a solution:
governments should heavily fine companies that are subject to data breaches.
If it cost them real money (proportional to their market cap, the amount of customers affected, and/or the severity of the breach) to allow a data breach, I’m betting they’d shore up those holes REALLLLLLLLLL QUICK.
This is always the answer. "How do we solve x in y industry?" Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.
That, or threaten to nationalize their industry. Corporations *hate * that.
Communications should always be nationalized. It was a mistake letting corporations gatekeep phones and internet.
Infastructure should be nationalized as a whole (roads, rails, water, heating, electricity, waste disposal and so on)
How about Intel?
Obviously a typo, nice one
Internet is also communication. works great in North Korea.
“Externalities” are just expenses that corporations incur that have to be paid by the public.
Make externalities losses again.
It'll also screw over anyone trying to break into the market, ensuring that the big tech companies remain unchallenged indefinitely.
Disagree if you add the three different factors that I added to account for this in my original comment:
As I wrote in my edit, I think the size of fine should be dependent on:
size of company
the reasonable expectation of security (which would partially attempt to decrease fines for unfixable breaches)
the number of unique users affected
I think that's a great starting point for effective legislation.
I also think this could easily be twisted to become yet another artificial barrier to entry.
I don't know what to do with that knowledge...I think you're correct, but I also think there's no way to pass such a law with its spirit intact today
I’ll put the ball in your court.
I’ve completely and irreparably broken up with electoral politics in the United States ever since my tax money started being spent solely on austerity and genocide. It’s about as likely for this to be introduced as a bill as it is for a third party to win a presidential election…ie IMPOSSIBLE.
They're too busy proposing legislation to create back doors that completely circumvent security in the first place.
Yeah, people shouldn't look to their government to protect them from this. Hell, I'd be willing to bet no small amount of taxes go to purchasing the leaked info at places like the CIA, NSA, and FBI.
Nah, throw the board members in prison. If the punishment for crime is a fine then it's legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person's data they allowed to be leaked.
If they get all the money because they're ultimately responsible, we should make them ultimately responsible.
if it means prison time for a middle/lower class person, it should mean prison time for everyone who is responsible for basically publishing logins and personal data.
no more geeting off scott free because you run a company. you're a prisoner like everyone else now.
Here's the summary for the wikipedia article you mentioned in your comment:
Nutraloaf (also known as meal loaf, prison loaf, disciplinary loaf, food loaf, lockup loaf, confinement loaf, seg loaf, grue or special management meal) is food served in prisons in the United States (and formerly in Canada) to inmates who have misbehaved, abused food, or have inflicted harm upon themselves or others. It is similar to meatloaf in texture, but has a wider variety of ingredients. Prison loaf is usually bland, even unpleasant, but prison wardens argue that nutraloaf provides enough nutrition to keep prisoners healthy without requiring eating utensils.
^to^ ^opt^ ^out^^,^ ^pm^ ^me^ ^'optout'.^ ^article^ ^|^ ^about^
As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.
Are these leaks even being reported by companies? Every article I have seen so far has just been compiling information off the new leaked data set someone picked up off the dark web or something.
They weren't, which is why the SEC updated 17 CFR Parts 229, 232, 239, 240, and 249.
https://www.sec.gov/files/rules/final/2023/33-11216.pdf
As of December 18th of last year, publicly traded companies are now required to disclose breaches. (soz, material cybersecurity incidents).
Prior to that, they could ...basically... just effectively sweep everything under the rug "like it never happened" minus a little handwaving and paper shuffling and nobody would find out about it until the information got sold and went public.
I'll have to go looking but I would be SERIOUSLY surprised if the disclosures apply to credit card companies (the MOST breached, historically) because I'm not sure what exactly qualifies someone as an asset-backed issuer, but it's at least a really good step for the REST of things.
Article 82, paragraph 1 of the GDPR:
Paragraph 2:
Article 24, paragraph 1:
Article 5, paragraph 1f:
Article 83, paragraphs 2 and 5:
Article 4, paragraph 7:
(All quotes are excepts, emphasis mine
https://gdpr-info.eu/
I think we can both guess why these companies never really face penalties that hurt them materially despite this being codified into law in the EU…
I got lost in the comments... why did you paste that here? To show that it is possible to make the data controller liable for breaches?
Exactly. This is supposed to show that what @demesisx@infosec.pub demands is already law in the EU.
They won't because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It's broken by design.
The EU has proven time and again that fines can hurt.