First, I will always agree that sharing information and disclosing breaches is a benefit, from a security perspective.

Has this pushed companies to invest more in prevention? I’m not sure. I think plenty is spent on avoiding disclosures, reducing compliance/risk scope, and satisfying audits. Does that improve prevention or detection? Hard to say.

I always wait for comparisons between IT security audits and financial audits; hell I often find myself thinking the same thing. My big problem with that, though, is similar to why I think checklist compliance is weak. Financial practices are very objective, painfully so. There are only so many ways to do things, and while it is mindboggling to non-accountants, they ultimately all do make predictable and comparable sense. IT solutions are still as much artful as they are predictable. One company’s network may dramatically differ from another company, even those in direct competition to each other in the same exact space. How do you get any sort of checklist that will be effective enough to offer value across the board without incurring even more financial barriers to entry into business in a digital world?

That rant dives pretty far into checklist compliance, but if anyone wants to start having public audits and comparisons like financial audits, it’s a dirty and necessary topic. Then again, it’s not like insurance (or financial audits to reflect business ethics/health) is an exact science…