Re: Fwd: Rate Stratfor's Incident Response

[Valdis.Kletnieks () vt edu]

On Sat, 07 Jan 2012 18:24:04 CST, Laurelai said:

> Well enjoy your doomed industry then. Ill continue to take great
> pleasure as the so called experts get owned by teenagers.

I'm not sure why you consider it "doomed".  It's only "doomed" if you have
some silly notion that a company needs to have 100% security.

We've not managed to totally secure the roads, there's still bad drivers out
there.  We've not managed to totally secure the credit card system, there's
still fraud.  But neither of those are "doomed" either - we just accept there's
bad drivers and buy car insurance, and the credit card companies accept
that there will be 2% to 6% fraud write-offs and chargebacks, budget
accordingly, and get on with business.

And it's the same in computer security - if you've figured out it's going to
cost you $250K/year (remember, salary, bennies, *and* overhead) to hire a
security geek, but there's only a 5% chance you'll get hacked in a given year
and you've got a business plan on how to *recover* for $100K, and swallow the
$600K in lost sales the week your website is down, you're still better off *not
hiring the expert and risking getting hacked*.

Just like any other business - banks, gas stations, and minimarts all accept
the chance of armed robbery as part of the risk of doing business.  Most will
deploy *some* countermeasures to lower the risk (usually a video camera or two,
and tell the clerks to hand over the money and try not to get shot), and at
some point say "Meh, that's enough. Time to get back to selling stuff and
making money".  Nothing different just because it's a cyber attack rather than
a physical one.

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/