Slashdot Mirror
CA Law Demands Public Disclosure Of Break-Ins
AuntieMisha writes "BusinessWeek has an article about a new California law passed that
requires businesses to publicly disclose information about break-ins. The only loophole is if there is an ongoing investigation and if the disclosure would harm the investigation. IMHO Big companies will have the resources to set up investigations even when they know it is unlikely to get anywhere, and business will go on as usual for them. Small businesses that don't have the resources to maintain an investigation will have their reputations ruined. Also, the article doesn't mention the contingency where a break-in occurs because of a software/hardware issue for which there is no released technical solution (i.e. anyone else who has software X would be susceptible to the same type of break-in). This is not good."
Small businesses can hire me as a security consultant. And I can do my consulting by hacking^H^H^H^H^H^H telecommuting my way into California from my New Hampshire home.
-- Thou hast strayed far from the path of the Avatar.
Naw, Chief Wiggum.
"I'd rather let a thousand criminals go than chase aftert them..."
You think that I'm crazy, you should see this guy!
Computer Associates is writing laws now? And I thought Microsoft had influence with the gov..
oh, right, California...
From the article...
They (the CA government) don't need to audit or enforce anything. It is self-enforcing for those businesses that feel they may be sued and have to pay monetary payments for NOT reporting the incident. If a given company doesn't feel it can be successfully sued due to the incident then there probably wouldn't be a public reporting of it.
It's just a CYA that would have to be handled on a case by case basis for each company and wouldn't be enforced by auditors and the like.
Are you bovilexic? Moo!
that won't help me if Bob Hacker over here can make it look like I never invested in the first place
For some of us, this could be a very good thing!
In case of fire, do not use elevator. Use water!
Microsoft (Nasdaq: MSFT) filed documents with the SEC today relating to a breach of network security.
According to the filings, at 5:23 AM last Tuesday, Microsoft's network was "owned" by a hacker calling himself "Z3r0 kew10r". While the hacker refered to himself as "1337" in his defacement of Microsoft's webpage, Microsoft CEO Bill Gates indicated that the security breach was very minor.
In a press release accompanying the filing, Gates said: "t#1s punk th1nks h3's 1337 but h3's just a littl3 scr1p7 k1dd13 and i'm g0nna sh0w h1m what 1337 is when m3 and the M$ haxx0r cr3w crak his b0xx0r!"
>> The only loophole is if there is an ongoing investigation
I would like to point out that ongoinginvestigation.com is still available for registration. Imagine the business you'll get in California! Certainly it will be worth a few bucks a month to a company's reputation to hire you to keep the investigation ongoing.
Heck, even some spammers do it. Look at this choice piece from buystainlessonline, it's hilarous:
Seems like some net vigilante typed 'or 1=1-- or something of that ilk into the spammer's remove link, or whatever...
Say no to software patents.
Computer security breaches are hardly similar to other issues of public safety. Announcing that a breach has occurred when there is no viable solution to keep it from happening again (either to the same company or other companies using the same software) would put the public's safety at an even greater risk.
If it involves any of my personal data, then I would rather them keep their mouths shut for damage control until there is a solution to the original problem.
It is sort of a catch-22 though. Other companies using the same software would be unaware of the vulnerability until a solution to the problem is found by that one company (which could potentially be slower than if many companies were looking for a fix). Maybe what we need is a *trusted* network (not in the ether sense of the word) where vulnerabilities could be posted without getting the word out to the people that would use this information maliciously.
"I have no special gift, I am only passionately curious." - Albert Einstein
On one hand you have lawmakers calling hackers 'thugs' and 'criminals' because -- and this is generally after months of reporting the problem to, say, Microsoft -- they notify the public that there is a security hole.
NOW they're going to make it illegal to not notify the public. Is telling the world about a security breach irresponsible or isn't it?
Yeesh. I feel like the whole gang from Bloom County who didn't know if they were watching "F Troop" or CNN and thus whether they should be enjoying the carnage or not.
My
Limekiller
Microsoft.
0 break-ins reported, 7,435 break-ins currently being investigated.
I'm Mr. Average Invester.
I find out that my #1 favorite stock i dumped thousands into on the advice of my dentist has recently fallen victim to a 11 year old IRC junkie.
Do I:
a. invest more money in my company, showing appreciation for the companies candor.
b. Murmur something very Zen to myself about the strongest tree bending in the wind, while noteing the fact that no real damage was done.
c. put a humming bird to shame franticly clicking the refresh button on IE6, neuroticly waiting for the stock to move a tick up or down.
d. scream "SELL SELL SELL" into my cellphone while barely avoiding a headon collision in my SUV.
e. dump all of my money into precious metals and move to an obscure island nation in preperation for the inevitable global ecconomic collapse.
and.... pencils down.
"Prediction: within 10 years, Windows will be a Linux distribution." Me, 7-6-2016
So if Ca. Congresscritter Berman's cyber vigilante bill passes, there will be a surefire method of dealing with pesky business competitors: attack their systems on the pretext that they might have some of your copyrighted data. If they report the breakin, they'll get bad publicity. If they don't report it, have your lawyers point out that fact to the appropriate authorites and they get busted for not reporting the breakin, also generating bad publicity for them. On the upside, this looks like a full-employment bill for security types.
Big corporations will have an internal investigation department and thrus never reveal nothing...
Small corporations will simply classify the event as "computer malfunction" and reinstall all the software and document the event as such...
In the end, California will be the only place in the world where there isn't any break in at all... at least reported publicly...
Cheers...
1. Buy Microsoft products
2. Exploit MS security holes
3. Short MSFT
4. Disclose information about the break-in
5. Profit!