3 ms·

Is this marketing VP a real person or just a hypothetical scenario? Because it doesn't make any sense to me that a marketing VP would have any decision making

Is this marketing VP a real person or just a hypothetical scenario? Because it doesn't make any sense to me that a marketing VP would have any decision making power about the need for security.

Kalium 11y ago
In corporate life, what makes sense and what's true are sets that rarely overlap as much as you'd hope.
shaggyfrog 11y ago
In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in slower logins, the development team could get immediate pushback to speed up the process, even at the risk of weaker security. Risk can be difficult to quantify, and if the focus is on chasing the short-term, you might be told to damn the torpedoes and get the product launched.
- iofj 11y ago
  In every programmer's experience, security can have a disproportionate amount of influence. For instance, they are unwilling to do any real development, yet have the authority to demand their stuff be used. There is no reason any authentication process has to use more than a single request + single response (and a single request and immediate reply from the auth server). The usual concerns like replay attacks, allowing third parties to relay data for the auth server can all be solved using encryption. In 15 years of working as a developer, I have encountered one company that actually does this both correct and fast. Security departments demanding that user authentication happen over an LDAP+Kerberos connection, for example, are commonplace and this is stupid and very slow, for no good reason.
bduerst 11y ago
Exactly. It's some vague personification here that doesn't make much sense. Who is this marketing VP who covers data breach insurance with their marketing budget? Now they're the ones making product decisions?
wanderfowl 11y ago
Hypothetical here, but I can very easily picture a world in which the Marketing VP decides whether the programming team spends [amount of time] hardening/reducing customer data storage, or implementing some new whiz-bang feature they can put on the homepage.

Is this marketing VP a real person or just a hypothetical scenario? Because it doesn't make any sense to me that a marketing VP would have any decision making power about the need for security.

Kalium 11y ago

In corporate life, what makes sense and what's true are sets that rarely overlap as much as you'd hope.

shaggyfrog 11y ago

In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in slower logins, the development team could get immediate pushback to speed up the process, even at the risk of weaker security. Risk can be difficult to quantify, and if the focus is on chasing the short-term, you might be told to damn the torpedoes and get the product launched.

iofj 11y ago
In every programmer's experience, security can have a disproportionate amount of influence. For instance, they are unwilling to do any real development, yet have the authority to demand their stuff be used. There is no reason any authentication process has to use more than a single request + single response (and a single request and immediate reply from the auth server). The usual concerns like replay attacks, allowing third parties to relay data for the auth server can all be solved using encryption. In 15 years of working as a developer, I have encountered one company that actually does this both correct and fast. Security departments demanding that user authentication happen over an LDAP+Kerberos connection, for example, are commonplace and this is stupid and very slow, for no good reason.

bduerst 11y ago

Exactly. It's some vague personification here that doesn't make much sense. Who is this marketing VP who covers data breach insurance with their marketing budget? Now they're the ones making product decisions?

wanderfowl 11y ago

Hypothetical here, but I can very easily picture a world in which the Marketing VP decides whether the programming team spends [amount of time] hardening/reducing customer data storage, or implementing some new whiz-bang feature they can put on the homepage.