Comment by uxp | Hacker News Reader

Comment by uxp | Hacker News Reader

Parent Full thread

The sentence before the quote is:

> Spaltro offers a hypothetical example of a company that relies on legacy systems to store and manage credit card transactions for its customers.

The full quote:

> Although Spaltro declines to talk about Sony’s security practices, he says that while Sony Online Entertainment is fully compliant, every company weighs the cost of protecting personal data with the cost of what it would take to notify customers if a breach occurred. Spaltro offers a hypothetical example of a company that relies on legacy systems to store and manage credit card transactions for its customers. The cost to harden the legacy database against a possible intrusion could come to $10 million, he says. The cost to notify customers in case of a breach might be $1 million. With those figures, says Spaltro, “it’s a valid business decision to accept the risk” of a security breach. “I will not invest $10 million to avoid a possible $1 million loss,” he suggests.

http://www.cio.com/article/2439324/risk-management/your-guid...

So I think what this boils down to:

Not an idiot: Spending $10M on insurance to offset a risk of $1M.

Idiot: Believing that the only cost of total loss of control over personal data is the cost of notifying people you lost control over their data.

With a bit more thinking he could know that 'notifying people' was practically "free" since there are a number of interested parties who will do that (news media, credit card agencies, federal agencies).

But what it really sounds like from that quote is that he has constructed a model in his head of what sort of data they have control over (or not) which is not very representative of what data they actually had, and control over.

And he's wrong. The loss isn't just 1 million, and calling a certainty a risk is just baffling. If we assume the legacy system actually needs 10 million in enhancements to be adequately protected, I think it's safe to say it's a train wreck security wise. For that, and other reasons (Sony assume they will get owned) then it's afe to assume the system is going to get compromised. So its not a risk anymore, it's a certainty.

So with that said, if the cost is report is 1 million, and the system is vulnerable, and they expect to get compromised then it's not just going to cost them just 1 million. It's going to cost them at least 11 million, or more.

Further, the "don't dix, just accept the risk" costs also won't just be 1 million, it's going to be 1 million every time it's compromised until they fix it. Since he's only accounting for the cost to report the breach, and the box is STILL owned and STILL vulnerable, it's going to keep getting compromised. So its 1 million times each event, which is a potentially infinite since nothing's changed to stop the next event.

To stop that infinite cycle, he has to pay to fix it, or keep paying to report. Either way he's paying more than 1 million. And since Sony I'm sure isn't that stupid, let's assume someone with common sense will order him to stop accepting the risk and the bleeding, then his real risk cost is 1at lesst 1 million to report and fix once that decision is made (and fixing is probably going to cost more now that the original 10 million since the system is now compromised too).

I'm not sure if he realizes this or not, or if it was a clumsy attempt to explain risk, but at least in the statements reported that's a critical flaw in his reasoning. And that's why what he said isn't just unconvincing, it's wrong.

If that's how Sony makes risk management decisions I have a Pinto to sell them.

Reply on news.ycombinator.com