Hacker News Reader

Comment by mathattack | Hacker News Reader

An IT exec at a Fortune 100 company once described it as, "With 25K, someone can get into our network. We just need to make than # higher than most of the other companies out there. We can never be 100% sure as long as it's real people involved."

View on HN

That sounds like the infosec version of "You don't need to outrun the bear, only outrun another person."

Might be a valid strategy if hackers only had the skills, motivations, and attention span of a grizzly bear.

That logic is presuming the attackers are randomly trolling, and that your company is not doing anything to attract a specific vendetta.

If the company is a "good citizen", then an approach like that may be justifiable. If you are BP, maybe not so much...

It also assume that the hacker won't just go after company A and company B

It's a valid point. I think it assumes that there's a time component involved too. The company did seem fairly on it's game on the time, and not one to flaunt controversy. But most hacks never get made public either.

One problem with that is that the hackers that you really need to worry about are ones who are coming after you: competitors trying to steal IP, business rivals investigating your deals and so on. These high profile attacks like the Sony attack are embarrassing, but the real business damage is probably done in other attacks that no one ever hears about.

Reply on news.ycombinator.com