Hacker News Reader

Comment by n2d4 | Hacker News Reader

For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.

View on HN

No rules or laws that require it. Closest requirement would be PCI around credit cards but you need lots of volume to be required to do an audit. HIPPA just requires you to do risk analysis and implement risk management. SOX is up to the auditor, when I was CTO at a public company, they were fine with me signing at attestation of all things we had implemented. Same with banks, no explicit requirement in both glba and fdic rules. Core bank systems are so old, none of that data is even encrypted neither is network traffic. Stuff is still in cobol.

Forcing function would be cyberinsurance policies that typically want to see audit results if you have multi-million dollar policy limits.

I think the fact that this is true and well known(amongst those that could abuse it) is evidence that infosec, by and large, is overemphasized.

> No rules or laws that require it

It will just be FTC knocking on your door…

The FTC will absolutely not knock on your door if you expose users's SSN to the internet.

Or the SEC, because one the breach/incident is public, the share price drops and failure to have disclosed those factors prior constitutes "securities fraud." Increasingly this it the default method of corporate regulation.

FTC will come knocking at your door even if you do pass an external audit and have Soc2/soc1/iso certification. Equifax is an example.

Who will promptly slap you on the wrist, wag their finger at you and send you on your way.

HIPAA requires that no entity involved leak any PHI or penalties will be applied, you absolutely have to do more than "do risk analysis/management".

https://www.hhs.gov/hipaa/for-professionals/security/laws-re...

There are state laws that this runs afoul of. https://www.mass.gov/regulations/201-CMR-1700-standards-for-...

https://www.mass.gov/doc/201-cmr-17-standards-for-the-protec...

It’s very basic. There’s no best practices clauses it’s all “reasonable” clauses. Also no requirement for an external audit.

Reply on news.ycombinator.com