3 ms·
> If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you d
by bo1024 9y ago
> If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems.
I see a big difference between preparing for the event of a hack, and believing that a hack is inevitable no matter what practices are in place.
- Johnny555 9y agoHow do you get your CEO to pay for the monitoring and other breach preparation if you've just told him that "We have air-tight security, we cannot get hacked"? CSO: We have airtight security, we cannot get hacked. CEO: Great! CSO: Please approve and fund this plan to handle a breach in case we are hacked. CEO: But you just told me we can't get hacked. CSO: Right, it's impossible. CEO: So why do we need to spend money preparing for it? CSO: Just in case. CEO: Just in case what? You just told me it can't happen. That seems a little like asking for money to prepare for an alien invasion or a zombie attack.
- dboreham 9y agoProbably the CEO would have read the document their Insurance Carrier made him sign that details the measures they need to keep cyber cover valid and therefore this conversation wouldn't happen.