Court: FTC Can Punish Companies With Sloppy Cybersecurity

jfruh writes: The Congressional act that created the Federal Trade Commission gave that agency broad powers to punish companies engaged in "unfair and deceptive practices." Today, a U.S. appeals court affirmed that sloppy cybersecurity falls under that umbrella. The case involves data breaches at Wyndham Worldwide, which stored customer payment card information in clear, readable text, and used easily guessed passwords to access its important systems.

Comments

Re:Written

[Falconnan]

Well, if you can't even minimally secure a customer's data, you probably shouldn't collect and keep it. This company was keeping unencrypted financial data on non-firewalled systems. "Bank-like"? Really? How about equivalent to a kid's lemonade stand? Seriously, if I set the bar any lower a snail with a broken foot could clear it.

What would make a big difference would be to force businesses beyond a certain size to assume liability for breaches, with minimum punitive damages and a presumption of responsibility. Then let the insurance companies dictate what will/won't be covered. As soon as there's a financial incentive, you'll get whiplash keeping up with security upgrades.

Frankly, I'd like to see companies punished for attempting to prosecute legitimate security research. However, one battle at a time seems wise.

Re:Written

[swillden]

I'd like to see a reasonable publication out of the FTC first. Bank-like security would cripple most shops.

"Bank-like security": I don't think that phrase means what you think it means.

I spent ten years as a security consultant in the financial industry, and bank security sucks. Large tech companies do a better job. Google, where I work now, is dramatically better than any major US bank, and although I haven't been behind their curtains it appears to me that Apple, Microsoft, Amazon, etc., are very good as well.

I think what it boils down to is that while banks know they need security they tend to be dominated by bankers, not the sort of technical people who know how to build secure systems. Big tech companies, on the other hand, may or may not actually need as much security but they have lots of geeks, among them a number who understand how to think about I/T security. Well, somewhat. Banks do tend to have a better understanding of the notion of risk mitigation, especially non-technical mitigation; techies tend to think in more absolute terms and about automated solutions. That absolutist, automated view allows fewer compromises, though, and more comprehensive and proactive analysis, where banks tend to be more reactive.

Anyway, I think you'd find that actual bank-like I/T security is not what you imagine bank-like I/T security to be, and wouldn't be particularly onerous.