How to get companies to invest into Information Security

This question was recently asked on and I wrote a lengthy reply that I’ll post here as well, since I work in this sphere:

You can see right now in Europe how to do it. We’ve tried it the hard way for 30 years, worked not so very much. For about the same time we tried to convince politics that this is a danger, not much happened. Oh yeah, one day SOX happened and that brought a tiny benefit, but mostly on the paperwork and consulting-hours side.

In Europe, right now massive investments into information security are being made, because of two laws that politicians have finally passed, both at the EU level. One is the General Data Protection Regulation and the other is the Council Directive “on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection”. You have an equivalent (referenced in the EU) from the NIST.

The fundamental change, and that answers your question, is that violations of these laws, and especially data breaches or other infosec events that could have been prevented with proper security, now carry massive fines. Let me quantify “massive”:

€20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater

The magic bullet is the 4% rule. It refers to global revenue, and it refers to corporate revenue — no more reducing risk by seperating your corporation into tiny “independent” companies. If a five-person subsidary of Facebook suffers a severe data breach, the fine can be $ 345 million.

Also, the law puts the legal liability to top-level management. That is the second magic bullet. Put CEOs and directors on the front line. Unless they can demonstrate that they took steps to comply to the technical and organisational requirements, they could go to jail. Now <b>that</b> gets top-level management moving.

So the simple answer is: Hit them where it hurts. Money and personal liability. Take away the corporate shield and diffusion.

Disclaimer: I do this stuff for a living. We are currently being drowned in projects to implement ISMSs and the GDPR is a main driver behind that.

Addendum: This gets you basic security levels. As soon as the risk management labels the residual risk as acceptable, that’s it. My personal opinion is that our security is still shoddy at those levels, and the main reason we’re not all dead is that most hackers are imbeciles and the only reason they can make a living with their laughable hacking skills is that security is such a joke. For illustration, look at the typical spam / phishing mails you get. Who would fall for that shit full of spelling errors, grammar mistake and my-blind-grandma-could-spot-this forgery? The answer is: If you send it to enough people, you will find enough idiots who do.

Once we have a basic security level across the board, the game will change. Lots of “hackers” will have to go back serving burgers and fries, but those with any actual skills will step up their game. And then we’ll be in a world of hurt. There’ll be an Equifax every month. My daily rate will probably skyrocket because supply and demand, but I’m still not looking forward to that.

If you are serious about security, as the saying goes you don’t have to run faster than the bear, only faster than your friends. But don’t walk just because they do. Start running now, because once they are eaten, you have to run faster than the bear.