2

Companies universally seem to invest massive amounts of time and development resources into protecting users from security-related crimes. The trend seems to be increasing steadily over the past 15 years.

What is the business reason that a company would want to protect the online security of users? What is the business benefit of protecting me, especially when the protections are so aggressive as to make me want to do business with somebody else? What would the consequence be to, say, Google, if a user's account was hacked into? What does Facebook stand to lose if an unauthorized person accesses my account? What does Amazon lose if somebody steals my package?

Note: I'm talking specifically about user protections, not about the internal cybersecurity practices of the company itself to protect its own resources. For example, I'm referring to e.g. mandatory 2FA, not to, say, a company keeping its servers secure (which would obviously cause business to be lost -- if users couldn't trust the company they wouldn't use it).

5
  • Let us continue this discussion in chat.
    – mentallurg
    Commented Apr 12, 2023 at 3:16
  • 1
    Delivery companies' protections on delivery is a direct result of protecting their own liability. You could sue as a result of a failed delivery. This has nothing to do with your account.
    – schroeder
    Commented Apr 12, 2023 at 14:32
  • @schroeder You can turn off 2FA now. There was a brief moment in time where Google forcefully enabled it for some accounts. I think they were just testing. Also I didn't blame the companies for my mistake. :)
    – Jason C
    Commented Apr 12, 2023 at 14:40
  • Then, if it was a "test", it was not "prioritising security over physical security and individual's livelihoods". If you are not "blaming" them, then your stories are irrelevant to what you asked.
    – schroeder
    Commented Apr 12, 2023 at 15:15
  • @schroeder The stories were relevant because it is important that a business would rather risk losing some users than having many users identities be compromised; that is, more value is gained by protecting users than by keeping users. This is to stress the claim that companies invest significant resources into protecting user identities, but also to hint that the motive might not be to protect users (i.e. it's the identities that are important). But I don't mind the edit. I just want it to be clear that it seemed like protecting user identities was very, very important.
    – Jason C
    Commented Apr 12, 2023 at 15:22

2 Answers 2

2

TL;DR: The digital identities of a user are the keys to increasingly valuable kingdoms in the digital world. This makes theft or misuse of such identities lucrative attacks. The need for increasing protection of digital identities is thus the result of their increasing value.

For a company it is necessary to ensure that only authorized users can access the company data. And the same can be said when it is about the users own data which are stored by some provider, like access to your mail, to health data etc: Only the real user or somebody they explicitly authorized should be able to read, write and modify the data. And this is also true when delivering goods - one has to ensure that they get delivered to the right person and it is actually the expected person who ordered the goods in the first place (and not misuse of stolen credentials).

The base of authorization is to authenticate the user first, i.e. making sure that they are actually the one they claim to be. This is done with digital identities, like employee accounts in a company, user accounts at some mail provider or health provider, or customer accounts at some vendor of digital or physical goods.

The more data and processes gets moved from the physical to the digital world, the more value is behind the digital identity of the user. And the more valuable the digital identity is, the more attractive it is as a target for attackers and thus the better the protection of this identity against theft and misuse needs to be.

Properly securing the company specific digital identity of its own employees is thus important for a company to properly restrict access to the company secrets. Making sure that the identity of a customer is secure is relevant for vendors to reduce their risks when delivering goods. And in cases like health providers or banks there are also often regulations which enforce proper protection of personal information - and properly securing the identity used to access these information is part of the regulations.

5
  • I see. So essentially, because the digital identity of the user has value to the company (in the information it contains), by protecting users the company is also protecting its own information assets. This makes sense thank you.
    – Jason C
    Commented Apr 12, 2023 at 14:36
  • (So for example, if I understand correctly: Facebook as an ad platform loses its effectiveness if many user accounts get hijacked and the new unauthorized users don't follow the expected patterns of interaction with other people. So it's in FB's best interests to make sure that users are using the platform as intended. Right?)
    – Jason C
    Commented Apr 12, 2023 at 14:37
  • 1
    @JasonC: I don't think that it is relevant for the ad business to be sure of the exact user identity - there is not much to loose if the identity is wrong. Instead it is important for the Facebook user itself that their identity cannot be misused - not for posting, not for viewing posts and also not for logging into to some external services with the Facebook account. Facebook is in a way obligated to make sure that misuse of account is very hard - this is at least the expectation of most users and crucial for the "Login with Facebook" offering. So it is about Facebooks reputation too. Commented Apr 12, 2023 at 15:06
  • That makes sense thanks. So it's more like, with e.g. "login with Facebook", if FB had a poor reputation for misused accounts, then sites wouldn't trust it enough to provide FB-based logins, and FB would lose access to the tracking information it gains from all of that, which is very valuable info. It's in FB's best interests for as many sites as possible to provide FB logins.
    – Jason C
    Commented Apr 12, 2023 at 15:19
  • 1
    @JasonC: Again, don't focus on the ad business. Tracking by Facebook and others is included in many sites and does not require strong identities. Tracking is also included in sites which don't provide FB logins. FB wants users to be secure so that they continue to use FB. Commented Apr 12, 2023 at 15:28
1

It's more cost-effective than not providing strong controls.

Customer support is expensive. Handling millions of calls from users needing to regain control over their accounts is VERY expensive. Google announced that when they ran a campaign to encourage 2FA, the number of compromised accounts that used 2FA dropped by 50%. That's a massive savings.

Some companies are in industries where there are regulatory requirements to protect users to a certain level, with very large fines if they do not.

Add to that the fact that companies offering weak controls are publicly criticised and many people choose their provider based on the basic security measures means that companies can gain and keep more users simply by "keeping up" with security best practices.

So, it is in every service provider's best interest, financially, to provide secure controls. Even if they are inconvenient to users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .