[wmf]

It sounds like a reverse lottery of pain to me. If LulzSec looks at you, you get to spend millions beefing up security while your competitors do nothing.

[bxr]

>If LulzSec looks at you, you get to spend millions beefing up security

...or, you know, be competent in the first place.

[wmf]

They can choose when and where to attack, but you have to defend everywhere all the time. I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

[bxr]

>I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

Yup, unfortunately this is true, and half-assing it because of this is what gets us onerous new internet legislation.