Discussion on:

Is outsourcing bad for your IT security?

How much were the cost savings?

How much were the legal fees and fines for the penetration?

Once you have those numbers, you can determine if it was a wise decision or not.

Yes.

In an ideal world you could validate that the third-party has security controls as good as yours, but typically you are handed an attestation document (SSAE-16) which might as well just say 'trust me'.

Furthermore, is water wet, is fire hot, is ice cold, and is tech republic more obvios than obvious man?

Only reason they outsourced in the first place was cost. Well there you go. Got what they paid for then didn't they?

Oh dear, how sad, never mind.

Companies will get only as much security as they are willing to pay for. No surprise that the lowest bidder takes minimal precautions.

otherwise they wouldn't be able to make the minimum bid that gets them the contract.

Which is why I don't get the surprise, this is Business 101.

Leaves you with the uncomfortable feeling they don't even know their own stuff, never mind ours.

...irresolvable ignorance/deliberate lack of value of all things digital. Management in companies and individual consumers see most all of this the same. "I want things to magically happen for free or dirt cheap, including perfect security, which I am entitled too just because I'm using the solution." This, incidentally, doesn't exist even when you are willing to put a premium on it.

Tell your kids to be veterinarians, doctors, teachers, physical therapists, etc, etc. Unless some sort of paradigm shift away from this totally clueless and disposable culture happens, they'll get to be happily blamed for managements poor decisions....including data compromises resulting from decisions you would have never made. I'm too old to, but if I could start over knowing what I know now, I would be doing something else completely.

One of the most frustrating problems is when a Trusted source goes to a little country on the east coast of the Med for their Software/System Eng's and later finds a souvenir or two embedded in the HW/SW end product. Naturally they are back at home long before we every fine out about it and all that's left is Damage control and a request (routinely ignored) to not do that again...

Every decision or strategy you employ for your business entails a risk. It is up to you to lower that risk by being smart in your business decisions.