SEC Update. Public companies must report cyberattacks within four days, unless it is a substantial risk to national security or public safety. To go live in December. 🤔 ⏳ www.bloomberg.com/news/arti…
@Munish I believe reporting in the public interest by private companies on cyber issues is severely compromised by commercial pressures, professional status sensitivity, and good old-fashioned denial.
@bkryer 🤔 doing the right thing is trying to be morally correct for society. It is good that at regional meet-ups, this is the drive forward.
@Munish No doubt. My point is rather cynical.
Reporting of incidents in a 96 hour window sounds fast to outsiders but is laughable inadequate from an oversight perspective, no matter what front line evaluations claim.
Voluntary means, as long as it doesnt make you look bad, or make your company lose any money or status, then you can report it. This is why we only hear about incidents which are too substantial to hide.
Software is our most vulnerable border.