In Victoria (Australia), is it illegal for a company to sell substandard security?
- Physical security (locks, access devices, keypasses, etc.)
- Digital security (data encryption, login credentials, etc.)
Two ways it could happen:
- At the time of sale they said it was fit for purpose but it had known published security vulnerabilities
- There were no known published security vulnerabilities but the security system was installed incorrectly leading to potentially easy breaches
There are two scenarios I can think of:
- The vulnerability was discovered due to a breach
- No known security breaches; a security review discovered the vulnerability
Do any of these variations change the legality?