4 ms·

I've come to a point where I really think no company will ever have even competent InfoSec practices. I've worked at a fortune-100 (terrible due to scale probab

• QAPereo 9y ago
  Mass casualties directly blamed on infosec failures would probably kick the legislature and public into action, but GOK what that action might be.
• sbrown12 9y ago
  Hiya Kevin. I wrote that Inc article. I feel you. How many times have you seen one (or all of these)... -credentials shared across teams -database credentials stored in plain text config files -unsecured mongodb clusters I used to think that none of this stuff would change until people were held accountable. Imagine if a data breach at work meant that I had to pay a fine so steep that I had to declare personal bankruptcy...bet that might get people's attention, but I doubt there's the political will to pass laws like that. Instead, I've spent my time trying to tackle it from the other end of incentives- how do we make security tools easier to adopt than the alternative? The SSO guys have done a great job, but there's plenty more to do. *Full disclosure, I founded a data security company