Sony's top executive defends the company's decision to wait a week after its major security breach to inform consumers, and said that it acted swiftly in doing so. Howard Stringer added that most security breaches go unreported to consumers. When companies do inform consumers, he says, it often takes them nearly a month to do so.
"We reported in a week. You are telling me my week wasn't fast enough?," said Stringer.
According to Stringer only 43 percent of companies inform consumers about security breaches. In the United States there are laws that require companies to tell customers about security breaches, and with Sony's high profile situation, you can bet that lawmakers are going to make those laws even tougher.
"This was an unprecedented situation," Stringer said, speaking publicly for the first time since the PSN and Station security breach.
Sony is still calculating how much this whole mess will cost them in the long run. Yesterday Stringer said that security breaches like the one Sony experienced may be the new norm for companies that handle personal data.
"There's a charge for system being down, a charge for identity theft insurance," said Stringer. "The charges mount up but they don't add up to a number we can quantify just yet."
Source: BBC
Comments
Re: Sony Boss Defends Company's Handling of Security Breach
"We reported in a week. You are telling me my week wasn't fast enough?," said Stringer.
Yes. That is EXACTLY what we are telling you.
Re: Sony Boss Defends Company's Handling of Security Breach
""We reported in a week. You are telling me my week wasn't fast enough?," said Stringer."
This guy needs a new public relations manager if the best he can do is be derisive in his responses.
What's a better way to have handled the above quote?
"We reported (it) in a week. We wish we could have done so faster."
Re: Sony Boss Defends Company's Handling of Security Breach
I'm not really defending his response, but I've watched enough 60 Minutes and Dateline to know that the reports can sometimes be royal d**ks and Stringer may have simply reached the end of his rope with a belligerent reporter (or reporters).
I'm interested in the statement that, "In the United States there are laws that require companies to tell customers about security breaches..." I spoke to our security officer at the company I work for and was told that legally you only have to inform customers if the data that was stolen was not encrypted. Sony's data was (well, they said it wasn't encrypted then they said it was hashed, like the average consumer would understand the difference). Bottom line, I'm not sure the laws are as cut-and-dried as the article is making them out to be.