3 ms·
There's 'compliance security' and then there's 'street-smart security'. They are very different things. Most organizations aim for compliance (it's cheap and e
by w8rbt 10y ago
There's 'compliance security' and then there's 'street-smart security'. They are very different things.
Most organizations aim for compliance (it's cheap and easy). They base security on contracts, certs and insurance policies.
Street-smart security practitioners are appalled by this. And, management doesn't understand why the 'security people' aren't on-board with 'compliance'.
It's a lot like the old west with Cowboys and Indians. Two totally different world views.
- ianai 10y agoPretty sure you hit it on the head. Over time, security breeches should alleviate this gap.
- spydum 10y agoIMHO, I dont think it will pan out this way. Companies are being breached, and neither their marketshare nor profits are being significantly affected. Aside from https://www.dailydot.com/layer8/code-spaces-hacked/ https://www.dailydot.com/layer8/code-spaces-hacked/ -- how many other companies do you know which really paid a significant price for being hacked? Yes, Anthem/BCBS, Target, HD, Sony, etc, etc have all had losses.. but they really havent been long-term impacted it seems. I dont know what the answer is, this sucks hard as both a consumer and an infosec person. I tend to view security as a "hidden performance" factor. As long as the security flaws don't inconvenience the paying customers too much, they simply don't care if they exist or not.
- user5994461 10y agoCompliances cover a lot of the basics.
- flukus 10y agoIsn't compliance the reason we have "at least one upper and lower case letter, at least one number, at least one special character and a drop of blood from your first born" style passwords that ruin security?
- user5994461 10y agoYou're not up to date on your compliance, this sort of stuff is forbidden by the last NIST regulation :D
- flukus 10y agoSo only 20 years until it filters down to us plebs then?