Registrants may seek to mitigate damages from a cyber incident
by providing customers with incentives to maintain the business
Hm, incentives like showing an improved reputational risk ranking?
Perhaps in order to prevent this sort of thing?
Cyber incidents may also result in diminished future cash flows, thereby
requiring consideration of impairment of certain assets including
goodwill, customer-related intangible assets, trademarks, patents,
capitalized software or other long-lived assets associated with hardware
or software, and inventory.
The SEC is still missing at least one connection between dots:
Prior to a Cyber Incident
Registrants may incur substantial costs to prevent cyber
incidents. Accounting for the capitalization of these costs is addressed
by Accounting Standards Codification (ASC) 350-40, Internal-Use Software,
to the extent that such costs are related to internal use software.
Sure, infosec costs money.
But if infosec actually prevents loss of customer goodwill, infosec
could attract and retain customers,
so infosec could be a source of profit.
If anybody knows about it, that is.
Internet security is in a position similar to that of safety in the medical industry. Many doctors have an opinion like this one,
“Only 33% of my patients with diabetes have glycated hemoglobin levels that are at goal. Only 44% have cholesterol levels at goal. A measly 26% have blood pressure at goal. All my grades are well below my institution’s targets.”
And she says, “I don’t even bother checking the results anymore. I just quietly push the reports under my pile of unread journals, phone messages, insurance forms, and prior authorizations.”
“Inadequate Investigation or Followup on Accident Reports.
Every company building safety-critical systems should have audit trails
and analysis procedures that are applied whenever any hint of a problem
is found that might lead to an accident.” p. 47
“Government Oversight and Standards.
Once the FDA got involved in the Therac-25, their response was impressive,
especially considering how little experience they had with similar problems
in computer-controlled medical devices. Since the Therac-25 events, the FDA
has moved to improve the reporting system and to augment their procedures
and guidelines to include software. The input and pressure from the user
group was also important in getting the machine fixed and provides an
important lesson to users in other industries.” pp. 48-49
The lesson being that you have to have built-in audit, reporting,
transparency, and user visibility for reputation.
Someone suggested that
Dennis Quaid should be reminded of the Therac-25
“if he thinks computers will reduce risk without a huge investment in quality,
quality assurance and operational analysis.”
For readers who may not be familiar with it,
the Therac-25 was a Canadian radiation-therapy
device of the 1980s that was intended to treat cancer.
It had at least six major accidents and caused three fatalities,
because of poor software design and development.
0. Premise: free and open software will stay indefinitely. Full stop. You may argue eternally, but free software is the ultimate disruptive technology, moving up from the low ground, replacing complicated and ill-fitting proprietary alternatives at every turn, such as web-browsers, e-mail clients, video players, office software, etc., which at one point cost money, but now most people find that they can no longer justify spending money to buy an upgrade for more “Clippy the Happy Assistant”. Proprietary software will only be able to stay relevant by searching out ever more niche applications, or by massive expenditure on research in high-end applications for which it will take time for the ideas and algorithms to filter down to the greater community, and thus a brief window of profitability will remain. Software patents are nothing but a destructive force to retard innovation, and with more and more of the technology and legal communities realizing this basic fact, software patents are about to go away forever.
I think he’s being a bit optimistic about software patents, but no more so than Windows advocates claiming that open software is a flash in the pan.
Then he gets into the undeniable stuff, chief of which is:
1.1 History’s greatest playground for malicious software. With unpatched machines on the internet taking only minutes to become infested with viruses, or become a slave bot for massive illegal spamming operations, Windows is a blight on the Internet’s infrastructure.
And it keeps getting better. He says he wrote it just as a game, but it pretty much spells out why I don’t use Windows, plus why Windows is a menace to the Internet.
There’s lots of academic and commercial effort put into stopping software and other intellectual property piracy, especially for videos. A form of risk management, I suppose, but one that ignores the much bigger risk to traditional intellectual property
of causing political blowback such as what just happened in Sweden:
“Together, we have today changed the landscape of European politics. No matter how this night ends, we have changed it,” Falkvinge said. “This feels wonderful. The citizens have understood it’s time to make a difference. The older politicians have taken apart young peoples’ lifestyle, bit by bit. We do not accept that the authorities’ mass-surveillance,” he added.
Funny thing about what happens when the majority of the population participates in an illegal activity: eventually it’s not illegal anymore.
At least partially, The Pirate Party puts its increased popularity down to harsh copyright laws and the recent conviction of the people behind The Pirate Bay. After the Pirate Bay verdict, Pirate Party membership more than tripled and they now have over 48,000 registered members, more than the total number of votes they received in 2006.
With their presence in Brussels, the Pirate Party hopes to reduce the abuses of power and copyright at the hands of the entertainment industries, and make those activities illegal instead. On the other hand they hope to legalize file-sharing for personal use.
Many of those abuses of power probably already are illegal; the appropriate laws
just aren’t being enforced. We saw this during alcohol prohibition in the U.S., and we
see it now with marijuana prohibition in the U.S. The first prohibition ended, the second probably will, and meanwhile, online “piracy” is on its way to being redefined.