Are Hosting Providers Really Incentivized to Prevent Data Breaches?

[johny899]

It is common for people to have trust in their web hosting company to keep their website's data secure and kept safely. I've had that same experience multiple times when launching a website or moving to a new server and being able to keep my website safe. However my concern is how serious hosting providers really care about securing data against breaches? Or do they do the bare minimum to keep your data secure?

Motivation for Security vs. Motivation to Make Money​

Most hosting providers will go into great detail on things like how fast or stable their servers are and place security discussions way down the list. Why are security discussions way down the list? Because it costs a lot to provide strong security. Customers are more price conscious when it comes to selecting their hosting than they are about security.

What I've seen is many hosting providers will take immediate action after a data breach has occurred. But do they make that same level of effort prior to a data breach occurring? Have you experienced the same?

Who is the Biggest Victim of a Breach?​

The "Shared Responsibility" Problem

Many hosting providers claim that security is a "shared responsibility". Although this seems fair, it makes it easier to put the blame on someone else.

In general:

• Customers lose data and trust
• Hosting providers lose some of their reputation
• Hackers move on to another target

If customers lose more than the hosting provider, will that put enough pressure on the hosting provider to improve their security? It makes you wonder, doesn't it?

What Better Incentives Should Look Like​

Match Loss with Prevention

With better incentives, Hosting Providers would:

• Spend more money to protect against attacks in the early stages of an attack
• Automatically turn on Strong Security by default
• Have a significant penalty to deter them from allowing avoidable breaches

Once I paid for "advanced security" only to discover that the amount paid was based on very basic security. I felt that was somewhat unsatisfactory.

Are Hosting Providers Doing Enough?​

To be honest, Hosting Providers do not always do as much as they should. Many spend a lot of their time focusing on fixing breaches rather than trying to eliminate them in the first place.