HIPAA and GLB..... (Score 0)

I am a security engineer at a financial company in the US. If my company buys and implements a piece of software with security holes, we are held liable under GLB. Why shouldn't the developer as well? It seems unfair to only punish the consumer. McDonald's is held liable for bad burgers and software companies should be too.

Under GLB my CIO can spend time in jail. Just think your CIO installs a farm of ISS (eeek) servers. You get cracked, and some guy in China has all your customer's SSNs. Now your CIO, Gates, and Baldwin become bunk buddies for the next six months. Hmmmm......