this post was submitted on 24 Dec 2023
343 points (99.7% liked)
Technology
59174 readers
974 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Is it just me or has 2023 been the year of the data breach? Maybe they are just larger or more widely reported. Just seems like there have been a fuck-ton of them this past year.
Hackers-for-hire on the darkweb is big business these days
While true, I'm not convinced that fully explains it. Having been in IT nearly 2 decades I feel like the second piece is cybersecurity budgets getting slashed. A lot of them have been super-basic shit like someone clicking on a malicious link.
Yeah, some youtube videos that cover basics and hiring a firm after a breech is pretty standard it feels.
Oh for sure, didnt mean to imply it was the only reason.
Spearphishing high-value targets, or even just phishing a company's email roster are very very common practices because they yield significant results.
Theres also the "insurance approach" to cybersecurity, where its cheaper to run PR for a little while and/or take out insurance policies against cyber attacks such as ransomware. The latter is a key factor as to why many companies dont mind paying the ransom at all.
I bet 2024 will have more. More stuff is online and we don't seem to be getting any better at securing it.
I don't think the problem is "we" securing things (we being cybersecurity professionals). I think the problem is companies seeing that it's cheaper to take the PR hit, pay the ransom, pay for cybersecurity insurance, etc than it is to pay for a properly secured network.
Cybersecurity is hard (citation needed) and costs a lot of money (citation needed). If a company figures it's cheaper to have a breach and deal with the fallout than it is to properly secure shit I can promise you what will happen.
As always, follow the $$$.
Profit > Security. These companies don't care so long as the consequences don't affect profit significantly enough. Infosec is always an afterthought, if considered at all.
Stupidest thing I've ever heard, you've clearly never worked for a company that's dealt with a customer info data breach. It costs them massive amounts of money to clean them up, pay for identity protection (never take that) and the PR alone costs them more in the end.