In November 2005, Jason Spaltro, executive director of information security at Sony Pictures Entertainment, sat down in a conference room with an auditor who had just completed a review of his security practices.
The auditor told Spaltro that Sony had several security weaknesses, including insufficiently strong access controls, which is a key Sarbanes-Oxley requirement.
Furthermore, the auditor told Spaltro, the passwords Sony employees were using did not meet best practice standards that called for combinations of random letters, numbers and symbols. Sony employees were using proper nouns. (Sox does not dictate how secure passwords need to be, but it does insist that public companies protect and monitor access to networks, which many auditors and consultants interpret as requiring complex password-naming conventions.)
Summing up, the auditor told Spaltro, If you were a bank, youd be out of business.
Frustrated, Spaltro responded, If a bank was a Hollywood studio, it would be out of business.
Spaltro argued that if his people had to remember those nonintuitive passwords, theyd most likely write them down on sticky notes and post them on their monitors. And how secure would that be?
After some debate, the auditor agreed not to note weak passwords as a Sox failure.
...
Spaltro offers a hypothetical example of a company that relies on legacy systems to store and manage credit card transactions for its customers. The cost to harden the legacy database against a possible intrusion could come to $10 million, he says. The cost to notify customers in case of a breach might be $1 million. With those figures, says Spaltro, its a valid business decision to accept the risk of a security breach. I will not invest $10 million to avoid a possible $1 million loss, he suggests.
That reasoning is shortsighted, argues Ari Schwartz, a privacy expert at the Center for Democracy and Technology. The cost of notification is only a small part of the potential cost to a company. Damage to the corporate brand can be significant.
