Comment by davidf18 | Hacker News Reader

Comment by davidf18 | Hacker News Reader

Parent Full thread

I once worked as a consultant to a subsidiary of one of the larger Cybersecurity vendors.

Many institutions have weak cybersecurity including healthcare concerns. In this Fortune article about he Sony hack, the CEO said basically that they did not want to spend the money for Cybersecurity. http://fortune.com/sony-hack-part-1/

Target and Lowe's POS terminals were hacked because they were told to upgrade their software to a newer version of the OS and they didn't do it. The CEO of Target was canned as a result.

Many firms and other institutions love the power of computing without spending the money and hiring the expertise needed to maintain the security. There are private security contractors that these groups can hire to ensure that their environment is fully secure .

In addition to financial audits, shareholders should insist on cyber security audits to ensure that the firm or institution is acting in a responsible manner.

Obviously acting in a responsible manner regarding Cybersecurity is not a guarantee, but many cases of hackers breaking in is because of not even making the attempt to be secure.

fully secure? aeh.

it's a tradeoff. you spend time, money and productivity loss (i.e. procedures) on IT security to decrease the risk of a successful attack. every additional dollar spent decreases the probability a bit further (if done right) but your returns are diminishing. at some point it's not worth anymore.

> "The TV5 attack fits into this pattern of highly-targeted attacks, rather than the kind of general criminal activity typically seen on the web."

in my opinion: no matter what kind of business you do, if you fall victim to the "kind of general criminal activity typically seen on the web" you're acting negligent.

then, after a certain point of increased protection attacks drastically decrease for most businesses because you're not worth the time and money it costs to attack you.

but fully secure? i mean, the stuxnet attack is the best counter example.

i compare it to healthy living: by investing time and money and refraining from doing certain pleasurable things you're improving your health and increase the chance to reach an old age. but it's no guarantee - you can still get hit by a car or succumb to cancer at age 20 just due to bad luck.

I think we agree. By doing your best to implement security measures (hire cybersecurity consultants, install the software they recommend, etc.) you are still exposed to risk, just significantly diminished since generally hackers would go after easier targets.

At issue is that many firms do not implement these security measures at all. The Sony people were repeatedly warned and had earlier breeches but didn't want to spend the money it took to follow measures recommended to them until after the attack. I think their mindset is not so unique and that many firms aren't doing what they can to try to eliminate the breeches. In some cases, the issues are internal, but in others customer lists are breeched, etc. or credit cards hacked as in Target, Lowe's, and others.

Is the word "cyber-" adding anything to the discussion here? Reminds me of 90's newscasts, right next to the "information superhighway."

"It's the security, stupid".

"""There are private security contractors that these groups can hire to ensure that their environment is fully secure"""

Leave the room as fast as you can if anyone ever pitches this to you.

IT security is mostly a risk assessment exercise at most companies. Likelihood of an incident*impact compared to cost. That's reasonable but I think both the likelihood and the impact are really hard to estimate well.

NOTE: I am not recommending this group for I don't recommend in this situation, but feel compelled to mention them to address this comment as a counterexample:

Mandiant was bought out by FireEye.

https://www.fireeye.com/services.html

I believe Sony was using them for forensics as well as establish their new more secure system.

It is important to set up systems so that hackers if (and when) they do breech, are found ASAP, and only get access to compartments and not the entire company.

There are also Israelis that I know of who have a good reputation in cybersecurity.

Reply on news.ycombinator.com