Schneier on Security

The best targets for this kind of information (the companies that keep large databases of personal information) have the least accountability for any harm caused through their negligence. That leads to a disincentive for anyone to improve the situation.

The majority of people who collect this information use it for marketing purposes. The goals of the marketing organizations are focused on acquiring customers. Data security isn't even an afterthought in these organizations.

Blame Canada!

Those evil-doers are certainly to blame. When fighting this evil, you are either with us or against us.

Hackers, crackers, and users constitute an axis of evil. That means they are armed with axes to hack away at our security doors in order to steal our identities.

I have nothing much to add, except I've used "scapegoat" instead of "folk devil". I figured folk devil is just the new word.

I'm assuming "folk devil" is from the German "Volksteufel", which is an old expression.

Means something like the same as a scapegoat, except that the original scapegoat was a physical goat that could have the blame for some action or event symbolically attached to it, and then be killed as ritual atonement.

So I guess the subtle distinction is that a 'scapegoat' exists to formally take the blame for something and be punished for it, while the 'folk devil' exists to remove the blame from someone else so that they won't be punished. The difference being that there's no real expectation of the folk devil ever being called to task, as it may not physically exist.

The term "folk devil" does come from German "Volksteufel", but has been used in English translation by sociologists since the 1970s:

http://en.wikipedia.org/wiki/Folk_devil

It is obviously somewhat similar in meaning to "scapegoat", but there are differences. A scapegoat is a person or group maliciously, falsely or inflatedly blamed for some actual problems, the usual implication being that another bears the real blame. When "folk devil" is used, the implication is that a network of folklore and urban legend has surrounded the victim. As a result the victim is blamed not only for real problems caused by others but fanciful ones arising from the folkloric framework, and even a general miasma of evil with no specific problem identified.

Isn't this like saying "Muggers blamed for lost wallets"? Without a correlation of damages to incidents, this data doesn't seem particularly interesting for a threat assessment point of view.

Given the much broader veil of secrecy now, and the dependency of the US government on private firms whose very contract details are classified, I fear that there could be large data losses that will not be disclosed to the public. An affected citizen might wonder, Who let my personal data get out, and find that no answer is forthcoming.

"An affected citizen might wonder, Who let my personal data get out, and find that no answer is forthcoming."

Indeed, it will become a felony to ask.

It's Acxiom NOT Axciom.

@Dutcher:
True. Criminal or malicious activity should only be one category of many. A situation where a mugger steals your wallet carries a much higher risk than a situation where you simply misplace your wallet (and may find it the next day). I wonder how much real damage results from criminal activity as opposed to simple negligence.

WE disgruntled employees will make YOU pay.

It's kinda silly to blame the hackers.

When designing a system, you have to assume that any security holes left open will eventually be exploited. That's the law of the jungle.

The real question how much resources you're willing to devote to making your system more secure. If you decide that a countermeasure isn't worth the tradeoff in time and resources, that's your call. If someone then compromises your security, you have nobody to blame but yourself.

Indeed a lot of breaches are "accidental". There are some tools that try to mitigate this type of data leaks. I wrote about them here: http://securetheworld.blogspot.com/2007/03/methods-for-network-based-devices.html

On one hand, you can "blame the victim" by simply stating (truthfully) that all too often users GIVE away access to confidential systems and data.
On the other, you can show that access controls and policies simply aren't being utilized in a logical fashion.
On the third hand (What? You don't have a third hand?), it's the criminals.
It's a hybrid problem that requires multiple layers of solutions.
But, as we all know, that tends to cost money.
How much security are you comfortable with compared to how much security a corporation is willing to provide?
Even more importanly, how much security are you willing to demand?

www.securityrants.com

This is the first time I've encountered "Folk devil"/Volksteufel. Seems handy. I will try it out in my discourse.Almost as useful a term as "urban legend."

It's just like that there Iranium.
Everyone knows Iranium is a NuCooler Weapon of Mass Distrustion.

So lets blame them coding-addiicted hackers, crackers, and users Would you want coding addicts doing stuff that changes your life?