Slashdot Mirror
Sad Reality: It's Cheaper To Get Hacked Than Build Strong IT Defenses (theregister.co.uk)
It's no secret that more companies are getting hacked now than ever. The government is getting hacked, major corporate companies are getting hacked, and even news outlets are getting hacked. This raises the obvious question: why aren't people investing more in bolstering their security? The answer is, as a report on The Register points out, money. Despite losing a significant sum of money on a data breach, it is still in a company's best interest to not spend on upgrading their security infrastructure. From the report: A study by the RAND Corporation, published in the Journal of Cybersecurity, looked at the frequency and cost of IT security failures in US businesses and found that the cost of a break-in is much lower than thought -- typically around $200,000 per case. With top-shelf security systems costing a lot more than that, not beefing up security looks in some ways like a smart business decision. "I've spent my life in security and everyone expects firms to invest more and more," the report's author Sasha Romanosky told The Reg. "But maybe firms are making rational investments and we shouldn't begrudge firms for taking these actions. We all do the same thing, we minimize our costs." Romanosky analyzed 12,000 incident reports and found that typically they only account for 0.4 per cent of a company's annual revenues. That compares to billing fraud, which averages at 5 per cent, or retail shrinkage (ie, shoplifting and insider theft), which accounts for 1.3 per cent of revenues. As for reputational damage, Romanosky found that it was almost impossible to quantify. He spoke to many executives and none of them could give a reliable metric for how to measure the PR cost of a public failure of IT security systems.
People have no options in the market for strong security, otherwise they'd punish these companies in sales.
Your info is already scattered all over the Internet from previous data breaches. It's cheaper to do nothing than build infrastructure that won't add to the CEO's annual bonus.
And you can bill the hacker the costs to fix stuff even when the system had no security at all.
Like our doors had no locks on them at all and some one broke in and now we have costs of $ to install locks on the doors.
This report looks at a lot of data, but (as noted in the Limitations section) it's only what was publicly available. Lots of breaches, especially w.r.t. ransomware, go unreported. Lots of breaches go undetected and/or aren't as easily measured as money (e.g. a rival company steals your un-patented trade secrets).
However, my biggest issue with this analysis is that its conclusion makes no sense. It says that the cost of cyber breaches is roughly equal to the cost of maintaining a defense. This paper fails to account for how money spent on cyber-defense reduces the money lost to cyber-attacks. If you're advocating for a radical reduction in InfoSec, this is the (only!) figure that matters.
Information Security is important, and there is good work being done here and more work needed. Cutting the InfoSec teams down will correlate to an increase in attacks that get through. This paper seems to be suggesting that reduced InfoSec budgets will somehow also limit the damage they combat. That makes no sense.
Use my userscript to add story images to Slashdot. There's no going back.
Then the spending on security will go up.
Don't use the internet for anything business related until business gets serious about fixing the problem. These people just want their profits and, like they learned getting that MBA, the easiest way to do profits is to re-direct costs. In this case, put the costs of doing business online onto the customers. Seriously, who pays the real price when a business gets hacked and all the customer data goes walking out the door/server? The customers suffer from having their data abused, that is who suffers.
Do you trust your ISP with your bank account number, address, phone number, etc? How about your bank? Your employer? Your local utilities? How many of these types of businesses have you seen hacking reports on these past years? All of them, repeatedly, every year.
Do you remember in 1995 when the business and banking communities were warned that the internet was not designed with security in mind, but the complete opposite? Do you remember that they all just said the business opportunities were just too great to ignore and that security would naturally follow usage?
The internet is not for business; the internet is for porn!
Everything in the Universe sucks: It's the law!
It's the cloud. Did any serious security tech ever think that was a good idea.
I'm hearing about cases where companies got hit with cryptolocker type viruses. And it wasn't something just just happened in a 30 minute period. It was a sleeper virus that waited 72 hours before activating, which invalidates all of your recent backups. All it would take is a sleeper to take 1 month, 6 months, etc to activate and then bam - you're done. No good backups. No data = no company. It would be a nightmare.
"A plan fiendishly clever in its intricacies"- Homer Simpson
If you find a vulnerability, companies must be exposed loudly and embarrassingly as possible. That (or legal threats) are the only things that can stop them.
Remember, there are companies out there that still don't hash passwords.
Irresponsible disclosure is responsible
It is also cheaper (and usually more pleasant) to live in houses with breakable glass windows and pickable locks, and just prosecute the burglars who flaunt the niceties and come in anyway.
In an optimal world, the costs would balance. If you spend zero on defense, then the breaches will increase due to the lack of defense. So, spend some on defense, make it harder to breach, breaches will always be possible, so where's the sense in spending more on defense than the breaches are costing?
Now, in military systems, the potential cost of a breach is rather high...
You do need to factor in the cost to the customers, which can be quite high when you "out" 50,000 customer credit card numbers... personally, I feel that the customers should be compensated actual cost of loss plus $100 for the hassle of having to jump all the security hoops associated with a CC# change. CC companies pay more than that in advertising to get a customer to switch to their CC.
If it's truly the case that it's cheaper to let data breaches happen than to protect against them, then some sort of incentive (or, punishment) needs to be put into place to change that situation. This is one of the few areas where government intervention is actually warranted: When something is not in the best interest of corporations but is very much in the best interest of citizens.
It's probably cheaper to let factory workers die on the job than it is to put all the safety measures in place to ensure they don't. Yet corporations put those safety measures in place anyway. They don't do it out of fondness of the workers, they do it because the government will shut them down if they don't.
113 million dollars to fix.
49 million dollars for the death and destruction costs.
Ford chose death and destruction over the lives of customers.
To this day I won't own Ford.
http://www.popularmechanics.co...
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Having tried the preventive approach on computer security for years, I came to the reluctant conclusion that it's a losing game. In every business scenario I've dealt with, it is simply impossible to protect against every threat and every zero-day exploit that comes down the pipe. Software patching, firewalls, antivirus, specialized appliances, you name it - they all have their limitations. You can protect against any number of possible exploits, but if only one gets through, you lose. So businesses must weight the costs spending more and more on preventive security solutions versus the cost of a security breach.
Obviously the implications of a breach are more severe for some businesses than others, but in many cases I deal with it makes more sense to focus on a good recovery solution rather than focussing mainly on prevention.
And got Congress to pass a law making arbitration legally binding. SCOTUS just recently upheld it. You'll find a clause in the EULA of every service you use. You done got sold out again.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I didn't see any mention of the productivity losses incurred by heightened security either. Our VPN is so locked down it's almost impossible to get things done remotely unless you happen to work in a business unit that is permitted to use terminal servers. To this day we aren't allowed to have video conferencing with parties outside the corporate firewall. I'd estimate the productivity loss to be around 5-10% of overall effectiveness.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
You can spend glorious tons of money on security and still get hacked. The problem lies is the internet has no boundaries built in and folks are trying to hide information. If it's networked to the internet, directly or indirectly, that information can get shared. Period.
How to fix? Only information you're willing to share with the whole world should be on a system that is networked.
I disagree. There are plenty of people who can use money well. The problem is that the system rewards people who make money for the purpose of making more money. The problem here is that security is not profitable, and the downside seems to be less expensive than not covering that overhead cost.
We need to find a way to properly incentivize security as its own end, because as I have noticed in my career, getting security resources is like pulling teeth, until someone threatens a suit or seriously damages the reputation of the company. Even then, it is usually more for window dressing.
Just realize half of all penetrations are as a result of social engineering or tokens that get passed out beyond your control.
Patch: keep your servers and workstations and laptops and mobile devices patched to the latest fix. Realize the latter two have a high chance of not being, due to their nature.
Backup: keep both daily and periodic backups. Have periodic full backups offsite. Always assume people will corrupt and mess with your key files. Keep offline offsite versions of those.
Rotate: don't always do the exact same thing. If someone hacks one machine in one place, you may notice differences if you switch it up a bit.
trust: never ever ever trust senior execs.
validate: never ever ever trust senior execs. they will give away access always.
confirm: never ever ever ever trust senior execs. they will order people to let the bad guys get access to your key data always.
(i'm starting to sense a pattern here)
-- Tigger warning: This post may contain tiggers! --
More important to me than the cost of keeping out a professional thief (after all, it's only money), is the inconvenience of a bulletproof security system - that's impacting quality of life at home, and similarly impacts the efficiency of businesses that over secure their assets.
Your house is protecting YOU first and foremost. Personal security is a great comparison with corporate security. We all do reasonable measures to protect ourselves but are hardly spending a large portion of our income to do so. We all know anyone that violates our property will be dealt with by authorities. We can only ask for reasonable security and a justice system that punishes those that go beyond that. Our justice system is AWOL on hacking.
x86 and systems based on it are hopeless from a security perspective, and that is even before considering the ticking time bomb that is Intel's Management Engine. It will be exploited eventually, and it would be surprising if the NSA wasn't already compelling Intel to backdoor it.
See the Mill security architecture, for an example of how a clever architecture can eliminate the bulk of common exploit vectors, and require little more than a recompile. It isn't the only option, but I highlight the Mill because it is a fascinating and novel architecture which also addresses many other long-standing issues with conventional systems. The security mechanisms also enable performant microkernels to be built, and protection between applications and libraries.
Operating systems will require work to take advantage of the protection features, but that will benefit everyone and be well worth the investment. This is the kind of "cyber" initiative I would like to see, rather than the focus on offensive capabilities. The latter poses a direct conflict of interest with securing systems, and ensures that adversaries will stock vulnerabilities rather than share and fix them.
We've known this for ages....and I learnt about it the hard way years ago as a webmaster.
I was tasked with managing a web server, and it turned out that PHP needed an immediate update.
Without further ado, to avoid the risk of getting hacked, I went and updated PHP to the next version up.
Turns out that doing so broke a number of customer webpages - who were reliant on some old broken and unmaintained code, who then complained and whined to our company that we threatened their businesses.
Lesson was simple: it is much easier to maintain old versions that keep things working AND DO NOTHING than to do any proactive security maintenance. This works in a number of ways.
Firstly, when you eventually get hacked IT IS NOT YOUR FAULT. It is the fault of some hacker and things will be seen that way. Blame gets shifted away from the admins anyhow.
Secondly, doing nothing is CHEAPER. It involves less risk, less change, and less responsibility. In a world where shareholders, finance and management dictate the aims of IT - you may as well fire the sysadmins because it's risky if they do any maintenance, meaning that since they're not going to do anything you may as well fire them. Just get contractors to build things to work once, then leave the systems on the internet indefinitely until they either end up getting hacked to the point of failure, or the hardware breaks down. Then rebuild the system from scratch with more contractors when that time eventuates.
That's how security patching works in the real world. In other words, it doesn't.
The thing is, it's ALL ABOUT SHIFTING BLAME in the world of IT, and IT is a risk, and it is expensive. That's why there is so much outsourcing combined with support contracts so company managers can point the finger at vendors when things go to hell and then walk away with legal indemnification and still keep their job when things eventually go to pot.
READY.
PRINT ""+-0