How Much Does a Reputation For Security Matter Anymore? 98
dasButcher writes "We often hear that businesses risk their corporate reputations if they don't have adequate security. It's been a common refrain among those selling security technologies: protect your data or suffer the reputational consequences. But, as Larry Walsh points out, the evidence is against this notion. Even companies that have suffered major security breaches — TJX, Hannaford, etc. — have suffered little lasting damage to their reputation. So, does this mean that reputational concerns are simply bunk?"
bad news is good news? (Score:4, Interesting)
Outside of geek circles, people might assume that if a firm has just suffered a security blunder, that they'll sure be addressing the issue seriously, and that they will make sure it doesn't happen again, as opposed to firms that haven't and presume that security is something other people need to worry about.
Don't know about repeat offenders though.
There is no "might" about it (Score:1, Insightful)
People want to feel safe. To that end, most people wind up playing mental games with themselves. Rather than make themselves aware of the danger (so they can make educated decisions that further their own safety) they just tell themselves stories about how governmental regulation or economic self-interest will drive these companies to provide the desired level of safety.
It isn't too different from doublethink (from the book, "1984").
It is so common, in fact, that those who refuse to engage in this practic
Re: (Score:1, Offtopic)
It isn't too different from doublethink (from the book, "1984").
I would read it but it was deleted.
Re: (Score:3, Insightful)
The biggest blunder a company can make is to try to hide that there has been a security breach because if they do try to hide a breach and it leaks then there may have been other breaches that aren't revealed.
Being open about breaches and the impact of the breach is not hurting a business, and it may also cause other businesses to look after their measures.
Repeated offenses may of course have an impact on the reputation.
For any laptop owners out there with sensitive data - use things like TrueCrypt. If you
Re: (Score:3, Interesting)
The biggest blunder a company can make is to try to hide that there has been a security breach
Correction: the biggest blunder a company can make is to hide that there has been a security breach AND THEN GET CAUGHT. If they're successful at hiding it, there is no penalty at all.
This is just one form of the classic Prisoner's Dilemma [wikipedia.org].
CD Universe died from bad reputation????? (Score:2)
In 2000, I think the thing that killed an online store selling CD's wasn't a bad online rep.
Think back. What was all the rage in 2000? Napster.
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
No, it simply means nothing is secure and if we stopped shopping from places that got hacked, there wouldn't be anywhere left to shop!
It only matters if you're affected (Score:5, Insightful)
Once your identity is stolen, it doesn't matter what precautions the leaking company took or what their reputation is.
And if your identity hasn't been stolen yet, it might be better to go with a company that has suffered an attack because they likely won't make the same mistake twice.
Reputations are just rationalizations. Real security is not measurable by reputation.
Re: (Score:3, Interesting)
Once your identity is stolen, it doesn't matter what precautions the leaking company took or what their reputation is.
I disagree. I might not file suit against TJ Maxx if it was beyond their control to stop this from happening. If, on the other hand, poor unreasonable company policy allowed a low level employee to sell it on the black market, I would probably be interested in a class action lawsuit against the company for poor protection of privacy.
Real security is not measurable by reputation.
Unfortunately, for a lot of these things, reputation is all you have to judge. And nobody's walking down the street passing up shopping at TJ Maxx because of the credit card
Re: (Score:2)
And nobody's walking down the street passing up shopping at TJ Maxx because of the credit card leak.
Of course not, your liability is limited by law to $50, and most CC companies waive that. When this happens again to TJ Maxx, the CC companies are going to have a come-to-Jesus talk with the execs of TJ Maxx and if they don't shape up, they won't be able to process credit cards anymore. *That* will put them out of business, not singular Joes and Janes Q. Public not shopping there.
Re: (Score:2)
The esteemed eldavojohn wrote, "And nobody's walking down the street passing up shopping at TJ Maxx because of the credit card leak."
I am. Bob's Store, too, and the one thing that I bought from Marshall's since then, I paid for with cash. I even told my wife not to go there any more if she's going to need a credit card: they're idiots and deserve to lose business.
Re: (Score:2)
Duh (Score:4, Insightful)
Look, people make mistakes. It happens. Even when those people are gathered into large groups. People also tend to forget things that aren't presently being trumpeted on the news as a "Big Deal".
Also, most folks don't like to worry about Security, and aren't too quick to criticize when others don't like it either. It is a classic PITA for the general public, without any measurable return on investment, so they're even further inclined to forgive. Only fear keeps us all in line, and people don't generally seem to criticize when the fear isn't working.
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
This depends what kind of business it is. If they're providing hardware and/or services to the geek crowd, it matters a lot. If they're selling shoes and their credit card information database gets stolen, it will probably have little (if any) lasting impact because even if people hear about it, they won't understand it and thus won't remember it. If they do remember, they'll pay cash the next time they go there, but they'll still go.
Mal-2
Re: (Score:2)
Re: (Score:2)
Look, people make mistakes. It happens. Especially when those people are gathered into large groups.
FTFY.
There are a bunch of reasons for that: mob mentality, political considerations, and being able to duck any responsibility for screwing up are definitely a part of that story though.
Re: (Score:1)
And don't forget the "It'll never happen to me" mentality that most people have.
If a company really wants to ruin its reputation, it'll get caught stealing from customers. Much more of a direct impact and much more identifiable by everyone, even those not directly affected, because - let's face it - who hasn't been ripped off at one point or another?
Re:Duh (Score:4, Interesting)
It's not so much forgiveness, I think, as resignation.
For the public, worrying about computer security is like worrying about an invisible, odorless poison gas that appears in completely random places. If they knew where the gas would strike, they'd fear those places. If the gas had an odor, they'd learn to fear it. If they knew who was responsible for creating the gas, they'd demand that outfit be shut down.
But if there's nothing they can do to protect themselves, they'll just ignore it and hope for the best.
That's what computer security is like for most people. They don't understand it, and they have good reason to suspect that the people who run the companies they deal with don't understand it. If a company gets hit with an embarrassing breach, they might reasonably conclude that its claim to have learned its lesson is just as credible as a different company's claim it hasn't been hit because it already knows better.
If you want to fix this, there are two ways, neither of them popular. The first is ore regulation of record keeping practices. The second is to establish liability of companies when information it is holding is misused.
Re: (Score:2)
For the public, worrying about computer security is like worrying about an invisible, odorless poison gas that appears in completely random places. If they knew where the gas would strike, they'd fear those places. If the gas had an odor, they'd learn to fear it. If they knew who was responsible for creating the gas, they'd demand that outfit be shut down.
But if there's nothing they can do to protect themselves, they'll just ignore it and hope for the best.
You've also just described "terrorism" (little-t) and included the most practical, rational approach to coping that we humans have. Unfortunately, our politicians and news media have adopted "Terrorism(TM)" as their poster child to manipulate the voters into marching to their prescribed beat of "fear, fear, spend, spend, attack, attack, vote, vote."
I just wish your suggested fixes worked as well in that problem space.
Obvious (Score:1)
No security available anywhere (Score:5, Insightful)
Essentially, no business properly secures their data. This means there are no alternatives, so there can be no repercussions from failure to enact proper security. People may moan and complain, but it isn't that they chose a company with poor security, it's that the industry just does business without security. For instance, no one will go without banking, and no bank is known for properly securing their data. Thus, clients can't create loss of profits for businesses with a poor security reputation.
Additionally, most consumers don't consider security as a main part of what they get from a service, thus not making it a major part of their decision. People don't look at banks (example) for how securely they store passwords, but instead for the interest rates provided. Again, until some start doing it right, none will be forced to.
Re: (Score:2)
Let's r
Re: (Score:2)
Maybe it's because security would also stop corporate fat cats from siphoning from the till?
Re: (Score:2)
Barings Bank (1762 to 1995) was the oldest merchant bank in London[1] until its collapse in 1995 after one of the bank's employees, Nick Leeson, lost £827 million ($1.3 billion) speculating - primarily on futures contracts.
Size matters (Score:5, Interesting)
From what I can see, size matters. The impact of a security breach on the business is inversely proportional to the size of the business. Small companies, big deal. Big companies, Eh - whataya gonna do?
For me they did (Score:2)
I live very close to stores from both companies and only pay cash at them now.
Re:For me they did (no they didn't) (Score:5, Insightful)
So then their security breach had no effect on their bottom line as far as you as a customer are concerned. In fact it could be argued that now they are making more $$ off you than before as they don't have to pay credit card transaction processing fees for your purchases.
Re: (Score:2)
Poor reporting (Score:3, Insightful)
Outside of the geek world, these data breaches either go unreported or just get a passing mention between breathless coverage of $CELEBRIDEATH and breathless coverage of $REALITY_SHOW_CONTESTANT. A lot of people simply don't realize that these things are going on.
Re: (Score:2)
Re: (Score:2)
Another thing that goes against us is the portrayal of hacking in tv shows and movies - they make it look super easy to hack into NSA systems and other HIGH-SECURITY systems that people start to believe its possible.
Corporations and reputations (Score:3, Interesting)
It is not about IT (it is about insurance companies in Nazi Germany), but provides a very good insight nonetheless.
And it's not even a long thread (Score:1)
Depends what industry (Score:3, Interesting)
If you're a relatively mundane manufacturing company and you leak customer data -- who cares?
If you're a Visual Effects studio and you leak shots from a major new film, "sonny, you ain't gonna work in this town again".
Re: (Score:2)
if you are a bank and your database of credit card number was compromised, your customers might think twice before opening any new accounts with your. or continuing their current one/s
Re: (Score:1)
Re: (Score:2)
If you're a relatively mundane manufacturing company and you leak customer data -- who cares?
"Chinese Employee Loses iPhone Prototype Kills Self"
http://mobile.slashdot.org/story/09/07/21/1814212/Chinese-Employee-Loses-iPhone-Prototype-Kills-Self [slashdot.org]
Most people not monetarily involved, think he was killed, not killed himself.
Reputation means very little; Response means a lot (Score:2)
Remember, the company you see on the news regarding their first ever data breach had a sterling security reputation... until it didn't.
I expect companies I do business with to do everything possible (within reason) to prevent breaches, but I also accept the fact that breaches are inevitable.
Be upfront and honest with me about it. Make sure it doesn't happen again. Repair any damage that was done. Do those things, and you'll have my business.
Re:Reputation means very little; Response means a (Score:1)
Re: (Score:2)
TFA links a company's security reputation to whether or not a breach occurred in the first place, not how the company responded to the breach.
There is a subtle difference between a reputation for having no security breaches and a reputation for responding well to security breaches.
I am claiming the former is not as important as the latter.
Re: (Score:1)
Not in Finance (Score:2)
Failure to meet, match or getting caught with your pants down on security can mean clients will not sign up with you due to your ranking or lack of credentials.
Re: (Score:2)
TJX breach didn't matter. (Score:2)
Most didn't hear of it, and those that did went "Oh, it was only X store and I wasn't affected"
Look at the TJ Maxx stores, they are a low end bargin retail chain, most of their business probably isn't even done with credit cards. Even those customers that were affected probably disputed the charges and moved on, without understand how crappy the security was. Most customers probably bought the "oh my, we're sorry this happened, we'll ma
Reputation doesn't matter in some industries (Score:2, Insightful)
A credit card transaction processing company, Heartland Payment Systems, suffered a serious data breach [2008breach.com] in 2008. My credit card information was compromised. Unfortunately, there is nothing I can do about the situation, other than get a new card.
I called Heartland. They told me they were implementing end-to-end encryption (I don't understand how such a company could possibly not already be using extensive encryption). I asked them for a list of the companies that process transactions through Heartland so
Re: (Score:2)
If I had modpoints, you'd get one, AC. The Heartland breach kinda makes TJX look minor, and many people who might have been affected would never know.
Shame TFA didn't mention this, because it's a much more serious vulnerability than one large retail chain, precisely because the customers don't know about it.
But to answer the question posed, I think I might be more likely to shop at a chain that's been compromised. Not right when the story is breaking, mind you, but several months later, certainly. If the
Not at all (Score:2)
It's insanely hard to sell security with the reputation angle. Why? Because neither companies nor customers give a rat's fuzzy bottom about it. Did you hear of anyone who canceled their account with a bank after said bank lost customer data by the gigabyte? Nah. Why? After all, now they fired that idiot that lost their data and now they're safe again. They said it themselves!
(if people actually heard about it, that is)
You sell security with the liability angle. If, and only if, there are some sizable fines
In the long term, it's irrelevant. (Score:2)
Two kinds of reputation (Score:2)
Having a reputation for being bad doesn't mean much anymore because so many people have screwed up. But a reputation for being good is worth it's weight in gold.
If I told you about how horrible my credit card company treated me, would you care? No, because you expect all credit card companies to suck. But if I told you they were fantastic, did a great job dealing with an Identify theft case, then you might want to know about it.
The Government Will Save Us (Score:2)
We've been trained all our lives that the Government will step in and save us. Is it any wonder that people no longer bother to research things before they put their money in them?
I research dang near everything I buy, right down to my toaster-oven. Because I do so much research, I know how to read the information out there, and it has been a -long- time since I bought something that was crap. (Except some toys I bought on impulse without researching!) Most people can't be bothered, so they pay the pric
Lack of large-scale consequences (Score:3, Interesting)
It's because so far, there haven't been any large-scale consequences resulting from the widely-publicized breaches.
Sure, a bunch of people's info got released, and some of those people had serious identity-theft issues resulting from it, but most of the people affected got new credit card numbers and moved on.
When there's a data breach that results in a bank going belly-up, or major stock fraud, or large loss of life, then a reputation for security might start to matter.
Of course it doesn't matter. (Score:1)
Ask ChoicePoint if this is No Big Deal (Score:2)
That had a non-trivial impact on a bunch of companies, including one I worked for. It caused us to spend a lot of time and money checking to see if we had a similar vulnerability (because our business was very SSN driven).
A difficult problem (Score:2)
a requirement (Score:2)
Many potential customers won't to business with you if you don't pass security audits. There's one major reason why having some security pays off.
The other reason, of course, is breach notification. It is very expensive to tell one million people you left their billing info on an anonymous FTP server.
Re: (Score:2)
What? How many Walmart customers do you know who do a full security audit (both physical and IT infrastructure) before shopping there?
We're talking about b2c as customers here not b2b... so most Joe Public customer's are not going to do security audits before shopping somewhere.
What's the correlation? (Score:1)
We're talking fear of identity theft with these kinds of lapses/buffoonery, yeah? Are there identified spikes in identity theft over a period following these incidents? Are there any numbers?
Factors (Score:1)
A lot of the impact depends on how important that company is to your daily life. When Hannaford got breached, well, here in Maine there are basically three major food chains. Wally World sells truly awful produce but has decent prices. Shaws sells really good quality stuff but tends to charge a bit more. Hannaford is the "happy medium" for most folks. Then, of course, there are the mom-and-pops and smaller chains who have their loyal following, and that's great too. But a lot of folks went to Hannafor
It depends on the customers view of the company (Score:2)
TJX is not a company that any one expects much out of from the standpoint of security. While it would be nice if they were not idiots, but they were and it is unlikely that anyone who has done business with them would be surprised.
If a company where to have a solid reputation for security, and have a large chunk of their revenue based on security offerings and where then to be discovered to not only have been exploited, but to have been exploited because they failed to make even a reasonable effort to prote
It mattered to Card Systems... (Score:1)
Tell Card Systems it doesn't matter...
http://www.consumeraffairs.com/news04/2005/cardsystems_sold.html [consumeraffairs.com]
Look at the Cyber Security Industry (Score:1)
No 9-11. Yet. (Score:5, Insightful)
The problem is there hasn't been the digital equivalent of a 9-11 yet. Once someone breaks into one of the major banks and zeroes the accounts of several million Americans, then you'll see a reaction. Too late. As usual.
Re:No 9-11. Yet. (Score:5, Interesting)
Re: (Score:1)
Not what it means at all (Score:2)
The bank is always right (Score:2)
And if the bank is wrong, it is still right.
Banks have *very* little liability. Many of the breaches have had to due with credit cards issued by, guess who? Banks. So who cares. The onus is on the card holders. The only rights a card holder has is in the creditors rights laws which do not cover identity theft.
So the bank can walk away from any civil liability in the case of identity theft. And just dare to try to impose liability. The banks will scream "We're too important to the economy! We'll stop lending
only accountants place value on intangibles (Score:2)
Whether it's "goodwill", "reputation", "contacts" or whatever. Yo often see these so-called assets listed when a business is up for sale. However no-one has ever found a way to measure the amount of any of these things that a company claims to have - klet alone being able to place an objective value on it. All these attributes are pretty much meaningless - either to customers or shareholders. The only thing that matters is price. Take low-cost air
It can happen to anyone (Score:2)
It's the general feeling, even among professionals, that security breaches are arbitrary. That, for every laptop with unencrypted harddrives and/or data left in the train, there is a remote root hole on the securest system that defies explanation because it was never thought of before.
Choice is almost as good. (Score:2)
It would be great if companies with sloppy security practices would be punished severely, go out of business, have all their executives waterboarded and sent to Guantanamo, etc. But the next best thing is if I, as an individual, have a meaningful opportunity for choice. I switched from Ameritrade to Scottrade because I, like many other people, was getting pump-and-dump spam sent to the email address that I used only with Ameritrade. (For years they claimed it was dictionary attacks, even though I and many o
SHA-1 is cracked! (Score:2)
http://it.slashdot.org/article.pl?sid=05/02/19/1424201&tid=93&tid=172&tid=218 [slashdot.org]
My theory is that security experts (and novices like myself) feel totally... betrayed, flummoxed, frustrated, whatever, that we are still using security algorithms that have been compromised. I know you need a supercomputer to crack SHA-1, however last I checked there are quite a few of those, and you can basically make a mini-supercomputer with a d
stopped shopping (Score:1)
It's about Business, not Security (Score:1)
Re: (Score:2)
The other company had no document retention policy, no archived emails and could not produce anything the prosecution wanted. They were scolded and fined $20 million.
And if they had a document retention policy that said "We don't keep anything, we burn it before we read it", they would have escaped the $20 million fine. (:-)