Hacker News Reader

Comment by debacle | Hacker News Reader

I think the only thing you can take from that is that Jason Spaltro is an idiot. When you have a billion dollar company, there's no such thing as a million dollar loss. Even the Sony Exchange address book is probably worth millions to the right people.

View on HN

The sentence before the quote is:

> Spaltro offers a hypothetical example of a company that relies on legacy systems to store and manage credit card transactions for its customers.

The full quote:

> Although Spaltro declines to talk about Sony’s security practices, he says that while Sony Online Entertainment is fully compliant, every company weighs the cost of protecting personal data with the cost of what it would take to notify customers if a breach occurred. Spaltro offers a hypothetical example of a company that relies on legacy systems to store and manage credit card transactions for its customers. The cost to harden the legacy database against a possible intrusion could come to $10 million, he says. The cost to notify customers in case of a breach might be $1 million. With those figures, says Spaltro, “it’s a valid business decision to accept the risk” of a security breach. “I will not invest $10 million to avoid a possible $1 million loss,” he suggests.

http://www.cio.com/article/2439324/risk-management/your-guid...

So I think what this boils down to:

Not an idiot: Spending $10M on insurance to offset a risk of $1M.

Idiot: Believing that the only cost of total loss of control over personal data is the cost of notifying people you lost control over their data.

With a bit more thinking he could know that 'notifying people' was practically "free" since there are a number of interested parties who will do that (news media, credit card agencies, federal agencies).

But what it really sounds like from that quote is that he has constructed a model in his head of what sort of data they have control over (or not) which is not very representative of what data they actually had, and control over.

And he's wrong. The loss isn't just 1 million, and calling a certainty a risk is just baffling. If we assume the legacy system actually needs 10 million in enhancements to be adequately protected, I think it's safe to say it's a train wreck security wise. For that, and other reasons (Sony assume they will get owned) then it's afe to assume the system is going to get compromised. So its not a risk anymore, it's a certainty.

So with that said, if the cost is report is 1 million, and the system is vulnerable, and they expect to get compromised then it's not just going to cost them just 1 million. It's going to cost them at least 11 million, or more.

Further, the "don't dix, just accept the risk" costs also won't just be 1 million, it's going to be 1 million every time it's compromised until they fix it. Since he's only accounting for the cost to report the breach, and the box is STILL owned and STILL vulnerable, it's going to keep getting compromised. So its 1 million times each event, which is a potentially infinite since nothing's changed to stop the next event.

To stop that infinite cycle, he has to pay to fix it, or keep paying to report. Either way he's paying more than 1 million. And since Sony I'm sure isn't that stupid, let's assume someone with common sense will order him to stop accepting the risk and the bleeding, then his real risk cost is 1at lesst 1 million to report and fix once that decision is made (and fixing is probably going to cost more now that the original 10 million since the system is now compromised too).

I'm not sure if he realizes this or not, or if it was a clumsy attempt to explain risk, but at least in the statements reported that's a critical flaw in his reasoning. And that's why what he said isn't just unconvincing, it's wrong.

If that's how Sony makes risk management decisions I have a Pinto to sell them.

> Jason Spaltro, then executive director of information security at Sony Pictures, called it a "valid business decision to accept the risk of a security breach" in a 2007 interview with CIO Magazine, adding he would not invest "$10 million to avoid a possible $1 million loss."

Who even hires these people?

People who don't know better, who's expertise is in other fields?

This is an exec though! If you're hiring for that position you either:

* know what you're doing with regards to hiring

* don't know what you're doing, and deferring to someone competent to make that hiring decision for you

I know understand why I'm not a CEO.

Alternate proposed requirements:

* an inflated sense of your own value

* competent enough to make other people believe it

Or, as hga proposed:

* be a useful mark to take the fall when it comes

I have seen people promoted to Information Security Officer who did not know the first thing about IT or programming, let alone hacking or things like APTs, server security or the top ten list of exploits.

I believe he was promoted because they wanted him away from his previous job, managing a software development department.

Not sure I follow. Are you saying that it's sane to spend 10x the value of a thing protecting against the loss of that thing?

I think what people are hinting at, but not explicitly saying is the $10M vs. $1M tradeoff between hardening a database and notifying users is a very narrow perspective. They're not weighing the possible monetary losses to their users or possible damage to their reputation.

And that's one of the many things that makes security hard: effectively weighing impacts against remediation costs (even measuring impacts is really hard). It appears Sony did it badly. But I agree with the statement that it doesn't make sense to spend $10m mitigating against a possible $1m loss.

How would you value the loss that Sony has faced here? If you guessed more than $1M, you did better than this guy.

But that's not the question. No-one's suggesting that Sony considered this specific scenario and arrived at loss impact of $1m, are they?

Hindsight is a wonderful thing.

An interesting question is this: You're the CISO of a major Hollywood studio. You have a budget of $xx million. Smart, well-resourced people are determined to destroy your company. What do you do?

Nice try, Scott

I've been told by someone in the field at a very high level that many are chosen to take the fall when something like this happens.

I wonder if he was thinking in terms of a DVD getting leaked as the worst possible thing that could happen. Sure, there's a loss of sales and movie viewership, but in the eyes of a studio a pirated product is a drop in the bucket these days.

its a film company most of that goes on paying the talent and the subcontractors

Reply on news.ycombinator.com