When a company publicly claims some massive dollar figure as a loss due to a security incident -- be it a break-in from a Kevin Mitnick, or a denial of service due to a worm such as Slapper, I always wonder: Is this company going to list this loss in its securities filings? Companies are required to report their financial well-being so that investors can reasonably evaluate them, and I cannot help but expect that a loss of millions of dollars due to a break-in or a leak would significantly impact most companies' bottom lines.

If companies are touting the size of their losses to the press to get sympathy, or to get sterner computer-crime laws on the books, but are not reporting these losses to their stockholders, then they are probably committing securities fraud. That's a really stupid thing to do.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/141/18096#18096