Not to put you out of a job, but I do think it's important for the government to take responsibility to coordinate and inform citizens of known issues (via CFPB) and provide a clearing house of information and research for citizens. CERT, who tracks vulnerabilities, is almost useless it seems today, but if it would coordinate with the CFPB to determine impact to citizens by various business, creating a proactive service for business as well as citizen. Information coordinated between CFPB an NSA on the vulnerabilities they find as they float their way thru the internet, goes to CERT and CFPB, then used to both inform the companies of their issues and make for speedier fix/notifications/reparations. While NSA wants to exploit what it finds for purposes of cyberwar advantage, has a duty first to protect it's own citizens.
In such a system both business and citizen gain value. The information from this arrangement can give business advantage of the expertise and leverage the information quickly to resolve issues they may not have $$(expertise) to find,
so they appear to customers proactive and responsive. Customers gain with visibility and accountability of the companies who don't resolve issues by making public that same information.
I'm not opposed to reasonable grace periods between telling a company they have a problem, and before it's made fully public.
Companies generally only focus on security to the extent they understand the risks of the impact. By making impact very clear and those impacted given a strong selection of reparations (a credit monitor being only a pale solution - useless to many today). I think CFPB could come up with additional recommendations on reparations for companies that citizens would accept.
Weakness of this argument.
Gov't is slow, evidently even with information.
Coordination and competing purposes between Govt Orgs are nothing to sneeze at - they are hard to resolve.
Businesses who feel they cannot quickly or inexpensively resolve a problem given to them will attempt to hide it, working against the idea business will gain value.
In such a system both business and citizen gain value. The information from this arrangement can give business advantage of the expertise and leverage the information quickly to resolve issues they may not have $$(expertise) to find, so they appear to customers proactive and responsive. Customers gain with visibility and accountability of the companies who don't resolve issues by making public that same information. I'm not opposed to reasonable grace periods between telling a company they have a problem, and before it's made fully public.
Companies generally only focus on security to the extent they understand the risks of the impact. By making impact very clear and those impacted given a strong selection of reparations (a credit monitor being only a pale solution - useless to many today). I think CFPB could come up with additional recommendations on reparations for companies that citizens would accept.
Weakness of this argument. Gov't is slow, evidently even with information. Coordination and competing purposes between Govt Orgs are nothing to sneeze at - they are hard to resolve. Businesses who feel they cannot quickly or inexpensively resolve a problem given to them will attempt to hide it, working against the idea business will gain value.