Did you see Google or facebook or Miceosoft customer databases breached ?

The issue is there is too little repercusions for companies making software in shitty ways.

Each data breach should hurt the company approximately to the size of it.

Equifax breach should have collapsed the company. Fines should be in tens of billions of dollars.

Then under such banhammer software would be built correctly, security would becared about, internal audits would be made (real ones) and people would care.

Currently as things stand. There is ZERO reason to care about security.

> The issue is there is too little repercusions for companies making software in shitty ways.

The penalty should be massive enough to affect changes in the business model itself. If you do not store raw data it cannot be exfiltrated.

I’m all for companies to not ignore their responsibility for data management, but I’m concerned that type of punishment could be used as a weapon against competitors. I can imagine that certain classes of useful companies would just not be able to exist. Tricky balance to make companies actually care without crippling insurance.

I agree. When it becames penalized by law, project owners/managers won't be tempted to take shorcuts and will have the incentive to give developers more time to focus on security.

There is some incentive to leave 0days in customer software, as it creates a commodity to be sold on gray 0day markets. On the other hand, securing your own garden brings less value then covering and deneing that your 'secure' cloud platform was whacked.

Microsoft lost their root keys to Azure. ¯\_(ツ)_/¯

We need both. The allowance by law enforcement to do cyber security as well as engineers not writing shitty software and lax IAM permissions or exposing private keys or the myriad of ways they mess up.

> Did you see Google or facebook or Miceosoft customer databases breached ?

Are you being facetious? Yes, yes, yes, they have.

I’m curious. What do you think about legalizing “hack-back” ?

Didn't Sharepoint get hacked the other day? :S

Microsoft just compromised the National Nuclear Security Administration last week.

Facebook was breached what last month?

Google is an ad company. They can’t sell data that’s breached. They basically do email, and with phishing at epidemic levels, they’ve failed the consumer even at that simple task.

All are too big to fail so there is only congress to blame. While people like Rho Khana focus their congressional resources on the Epstein intrigue citizens are having their savings stolen by Indian scammers and there is clearly no interest and nothing on the horizon to change that.