3 ms·

Two words: Regulatory Capture. See Also: Boeing, IBM, CGI Group, AT&T, NRC, etc.

grzm 10y ago
I don't read that as being the point of the article. Regulation is not even mentioned or alluded to. Also, my understanding of regulatory capture has little to do with regulation slowing down business. If anything, rather the opposite. But that's off-topic anyway, and definitely not appropriate for this week. Edited to update comment on regulatory capture.
- Afforess 10y ago
  I don't know what you're talking about, it's in there plain as day. The company has a department called IT Security. Not IT. Not Security. IT Security. Companies that legitimately care about security integrate security personnel with all of their operations, into every department. Top-down security departments exist to check boxes on regulatory forms. So I will be shocked if "IT Security" is not a made-to-order department whose existence is solely to satisfy things like PCI, HIPAA, etc.
  - cortesoft 10y ago
    What? In any large company, you are going to have access controls - not everyone is going to be allowed access to every system. In the example given, the guy was requesting access to a new system he didn't previously have access to; having a security team that is in charge of that access doesn't seem to have anything to do with regulation.
  - trdtaylor1 10y ago
    True, but the greater danger of integrating security into every department is discounting security in favor of the main requirement of your department. Your department is viewed for political and performance reasons, budgeting time away from the main goal of your area towards security is technically ... waste. Additionally, you ignore the business logic cross-departmental issues when you do not have a centralized security department.
  - grzm 10y ago
    I understand your point if you're referring to government regulation. I don't think your argument makes sense if you're referring to "regulatory capture": Regulatory capture is a form of government failure that occurs when a regulatory agency, created to act in the public interest, instead advances the commercial or political concerns of special interest groups that dominate the industry or sector it is charged with regulating.[0] [0]: https://en.wikipedia.org/wiki/Regulatory_capture https://en.wikipedia.org/wiki/Regulatory_capture In the case of regulatory capture, you'd think regulation would most likely be reduced rather than impeded.
    - dragonwriter 10y ago
      > In the case of regulatory capture, you'd think regulation would most likely be reduced No, in regulatory capture you expect regulation to be increased so as to form a barrier to entry to new competitors, while advantaging (comparatively) established incumbents that have the inside track with regulators and the regulatory process.
      - grzm 10y ago
        Makes sense. Thanks for the insight. My believe main point that using the term "regulatory capture" is not what the commenter intended or is appropriate in this case (as it's regulation in general that would affect this rather than tangential effects of regulatory capture).
  - user5994461 10y ago
    Just sign the paper for PCI or HIPAA and here you go. Fully PCI and HIPAA compliant. There is really no need for full IT Security PCPAA compliance department.
quaunaut 10y ago
Honestly, that's way too simplistic a point of view. The biggest reason large companies that move slow continue to succeed in their original business, is because their original processes and flow are from when they were growing, while they were learning and more agile in their space. As a result, they still generally provide much more value there than the average startup can compare to, in at least a few specific areas, specific to each business. That's why the blue ocean approach often succeeds much more than trying to take on a large company at their own game. It's hard, because it's a huge organization dedicated to being good at that one thing- and nothing more. So the better answer is to sidestep, not to take them on directly.

grzm 10y ago

I don't read that as being the point of the article. Regulation is not even mentioned or alluded to. Also, my understanding of regulatory capture has little to do with regulation slowing down business. If anything, rather the opposite. But that's off-topic anyway, and definitely not appropriate for this week. Edited to update comment on regulatory capture.

Afforess 10y ago
I don't know what you're talking about, it's in there plain as day. The company has a department called IT Security. Not IT. Not Security. IT Security. Companies that legitimately care about security integrate security personnel with all of their operations, into every department. Top-down security departments exist to check boxes on regulatory forms. So I will be shocked if "IT Security" is not a made-to-order department whose existence is solely to satisfy things like PCI, HIPAA, etc.
- cortesoft 10y ago
  What? In any large company, you are going to have access controls - not everyone is going to be allowed access to every system. In the example given, the guy was requesting access to a new system he didn't previously have access to; having a security team that is in charge of that access doesn't seem to have anything to do with regulation.
- trdtaylor1 10y ago
  True, but the greater danger of integrating security into every department is discounting security in favor of the main requirement of your department. Your department is viewed for political and performance reasons, budgeting time away from the main goal of your area towards security is technically ... waste. Additionally, you ignore the business logic cross-departmental issues when you do not have a centralized security department.
- grzm 10y ago
  I understand your point if you're referring to government regulation. I don't think your argument makes sense if you're referring to "regulatory capture": Regulatory capture is a form of government failure that occurs when a regulatory agency, created to act in the public interest, instead advances the commercial or political concerns of special interest groups that dominate the industry or sector it is charged with regulating.[0] [0]: https://en.wikipedia.org/wiki/Regulatory_capture https://en.wikipedia.org/wiki/Regulatory_capture In the case of regulatory capture, you'd think regulation would most likely be reduced rather than impeded.
  - dragonwriter 10y ago
    > In the case of regulatory capture, you'd think regulation would most likely be reduced No, in regulatory capture you expect regulation to be increased so as to form a barrier to entry to new competitors, while advantaging (comparatively) established incumbents that have the inside track with regulators and the regulatory process.
    - grzm 10y ago
      Makes sense. Thanks for the insight. My believe main point that using the term "regulatory capture" is not what the commenter intended or is appropriate in this case (as it's regulation in general that would affect this rather than tangential effects of regulatory capture).
- user5994461 10y ago
  Just sign the paper for PCI or HIPAA and here you go. Fully PCI and HIPAA compliant. There is really no need for full IT Security PCPAA compliance department.

quaunaut 10y ago

Honestly, that's way too simplistic a point of view. The biggest reason large companies that move slow continue to succeed in their original business, is because their original processes and flow are from when they were growing, while they were learning and more agile in their space. As a result, they still generally provide much more value there than the average startup can compare to, in at least a few specific areas, specific to each business. That's why the blue ocean approach often succeeds much more than trying to take on a large company at their own game. It's hard, because it's a huge organization dedicated to being good at that one thing- and nothing more. So the better answer is to sidestep, not to take them on directly.