mailing list archives
Re: Fwd: Rate Stratfor's Incident Response
From: Valdis.Kletnieks () vt edu
Date: Sat, 07 Jan 2012 20:05:14 -0500
On Sat, 07 Jan 2012 18:24:04 CST, Laurelai said:
Well enjoy your doomed industry then. Ill continue to take great
pleasure as the so called experts get owned by teenagers.
I'm not sure why you consider it "doomed". It's only "doomed" if you have
some silly notion that a company needs to have 100% security.
We've not managed to totally secure the roads, there's still bad drivers out
there. We've not managed to totally secure the credit card system, there's
still fraud. But neither of those are "doomed" either - we just accept there's
bad drivers and buy car insurance, and the credit card companies accept
that there will be 2% to 6% fraud write-offs and chargebacks, budget
accordingly, and get on with business.
And it's the same in computer security - if you've figured out it's going to
cost you $250K/year (remember, salary, bennies, *and* overhead) to hire a
security geek, but there's only a 5% chance you'll get hacked in a given year
and you've got a business plan on how to *recover* for $100K, and swallow the
$600K in lost sales the week your website is down, you're still better off *not
hiring the expert and risking getting hacked*.
Just like any other business - banks, gas stations, and minimarts all accept
the chance of armed robbery as part of the risk of doing business. Most will
deploy *some* countermeasures to lower the risk (usually a video camera or two,
and tell the clerks to hand over the money and try not to get shot), and at
some point say "Meh, that's enough. Time to get back to selling stuff and
making money". Nothing different just because it's a cyber attack rather than
a physical one.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/