4 ms·
It can be quite terrifying to consult for some banks. That’s when you get to see how bad things really are in the industry, and how common some bad practices ar
by bradknowles 9y ago
It can be quite terrifying to consult for some banks. That’s when you get to see how bad things really are in the industry, and how common some bad practices are.
For these banks, anything is okay, so long as the auditor okays it. And the auditors are on the payroll of the bank.
In one case, they wanted OS patching to be done no more than yearly, and they didn’t want the OSSEC tools to be run to tell them if there were any vulnerabilities unless they were planning on doing OS patching. But the auditor had okayed it, so that was that.
- jlgaddis 9y ago> ... they didn’t want the OSSEC tools to be run to tell them if there were any vulnerabilities unless they were planning on doing OS patching. But the auditor had okayed it, so that was that. Well, if they weren't going to bother patching anything anyways, there's really no point in running a vulnerability scan, I suppose.
- adrianN 9y agoIn fact it's probably counterproductive as then you know that there are vulnerabilities and might have more liability for not patching them than if you didn't look in the first place.
- confounded 9y agoWhy is that counter-productive?
- jlgaddis 9y ago"We didn't know we were vulnerable" ... versus ... "We knew we were vulnerable but just didn't bother patching"
- confounded 9y agoHow does this reduce productivity?
- jacobolus 9y agoThe 'product' is expected bank profit.
- thaumasiotes 9y ago"Counterproductive" is a normal English word unrelated to "productivity". Taking an action is counterproductive if it leaves you worse off than you would have been if you hadn't done it. Note that the only definition of "counterproductive" here ( https://www.merriam-webster.com/dictionary/counterproductive https://www.merriam-webster.com/dictionary/counterproductive ) is "tending to hinder the attainment of a desired goal".