What’s Next In Breach Analysis?
I asked recently “Is It Time To End the Breaches Category?” I think we, amongst others, have driven real change in expectations. Organizations outside the US, not compelled by any law, have chosen to notify customers. (Examples include a Bank of Montreal latop, the Government of British Columbia, KDDI, a Japanese phone company, the Bank of Bermuda, the Grand Hotel, Brighton, UK, and others.
When I started on this, I didn’t have a deep analysis. I found it interesting, and I’ve done well by following my instincts in the past. I now know that California’s SB 1386 is one of the most important developments in recent information security history. The opportunities that it creates for empiricists are tremendously important. Similarly, the opportunity to overcome the military-derived anti-disclosure approach to information security is tremendous, rare, and not to be squandered.
As most honest practitioners are willing to admit, security work is tremendously challenging because there are a great many things we don’t know. Metrics are hard to gather, and hard to share, in part, because we have a fear of talking about what’s going on. But over hundreds of breaches, there are few lost jobs. Only one company has sold their assets at a fire sale (CardSystems Solutions. There’s 30+ mentions in our breach category archive.) It seems the stock market doesn’t care. I’ve argued these points in more detail in “Transparency is good for the soul (of our profession)” and more generally in the breach analysis category.
So where do we go from here?
It seems that within the US the attitude of public disclosure is now fairly standard. Not so outside:
http://www.law.com/jsp/ihc/PubArticleIHC.jsp?id=1158682105389
It’s interesting pondering on the differences. Is it the existance of laws? Or is it the distance of courts? Or is the risk of Californians perverting ones database low enough to ignore?
Chanelling William Gibson, I’ll simply say that the future isn’t yet evenly distributed.