5 ms·

>Who exactly is responsible for unrecognized vulnerabilities? Everyone? No one? One dude who everyone sorta thought handled security stuff? It's as clear as mud

>Who exactly is responsible for unrecognized vulnerabilities? Everyone? No one? One dude who everyone sorta thought handled security stuff? It's as clear as mud. Security team with people who do it full time. Betting your security on the one dude who sorta did everything should be criminal. Aka, not this: http://i.imgur.com/a7S95nG.jpg http://i.imgur.com/a7S95nG.jpg

calgoo 9y ago
What does professional even mean (from her past)? To me it means useless middle management that accomplishes nothing apart from moving numbers around to make them look good.
- yorwba 9y ago
  I always thought "professional" as the sole job description (i.e. not "professional X") was used as an euphemism for "prostitute", so I'm wondering why someone would put it on their resume like that. Did I just learn the word in the wrong context?
ranci 9y ago
What if management doesn't hire a security team? What if management hires incompetent security team?
- FLUX-YOU 9y ago
  >What if management doesn't hire a security team? That's clearly negligence. >What if management hires incompetent security team? That's harder to do because you have to establish competence, which has led to a bunch of hazing rituals via whiteboard for general software development and a lot of other insecurities. Being a security professional isn't regulated by law, so you can't check the law to determine if someone's competent. So who's opinion do you trust, and why do you trust their competence? An expert witness, maybe?
  - ranci 9y ago
    >What if management doesn't hire a security team? "That's clearly negligence." Great so you just made it illegal or impossible to create a start up, congratulations.
    - FLUX-YOU 9y ago
      >Great so you just made it illegal or impossible to create a start up, congratulations. All of this is under the context you'd be handling a lot of PII or sensitive information, in which case, yes, I don't want just any start up to work with PII without some kind of security team.
    - stordoff 9y ago
      If you're handling sufficiently private data, then there shouldn't be a low barrier to entry. Starting a medical startup without the requisite expertise would be negligent; I don't see why certain classes of private information should be different.
unclebucknasty 9y ago
>Who exactly is responsible for unrecognized vulnerabilities? Everyone? No one? Here's a quote from Equifax's early release on the breach [0]: Equifax said that, it had hired a cybersecurity firm to conduct a review to determine the scale of the invasion. So, to your question, I'm going with "no one", at least internally. It's beyond belief (well, not really anymore); but, not only do they not have security covered internally (criminal in itself), but they don't even appear to have a regularly engaged cybersecurity firm. They had to go out and hire one post facto. [0] https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 https://investor.equifax.com/news-and-events/news/2017/09-07...

calgoo 9y ago

What does professional even mean (from her past)? To me it means useless middle management that accomplishes nothing apart from moving numbers around to make them look good.

yorwba 9y ago
I always thought "professional" as the sole job description (i.e. not "professional X") was used as an euphemism for "prostitute", so I'm wondering why someone would put it on their resume like that. Did I just learn the word in the wrong context?

ranci 9y ago

What if management doesn't hire a security team? What if management hires incompetent security team?

FLUX-YOU 9y ago
>What if management doesn't hire a security team? That's clearly negligence. >What if management hires incompetent security team? That's harder to do because you have to establish competence, which has led to a bunch of hazing rituals via whiteboard for general software development and a lot of other insecurities. Being a security professional isn't regulated by law, so you can't check the law to determine if someone's competent. So who's opinion do you trust, and why do you trust their competence? An expert witness, maybe?
- ranci 9y ago
  >What if management doesn't hire a security team? "That's clearly negligence." Great so you just made it illegal or impossible to create a start up, congratulations.
  - FLUX-YOU 9y ago
    >Great so you just made it illegal or impossible to create a start up, congratulations. All of this is under the context you'd be handling a lot of PII or sensitive information, in which case, yes, I don't want just any start up to work with PII without some kind of security team.
  - stordoff 9y ago
    If you're handling sufficiently private data, then there shouldn't be a low barrier to entry. Starting a medical startup without the requisite expertise would be negligent; I don't see why certain classes of private information should be different.

unclebucknasty 9y ago

>Who exactly is responsible for unrecognized vulnerabilities? Everyone? No one? Here's a quote from Equifax's early release on the breach [0]: Equifax said that, it had hired a cybersecurity firm to conduct a review to determine the scale of the invasion. So, to your question, I'm going with "no one", at least internally. It's beyond belief (well, not really anymore); but, not only do they not have security covered internally (criminal in itself), but they don't even appear to have a regularly engaged cybersecurity firm. They had to go out and hire one post facto. [0] https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 https://investor.equifax.com/news-and-events/news/2017/09-07...