> The second thing that troubles me is security "best practices" today may not be best practices tomorrow. Some of his example companies are using practices tha

> The second thing that troubles me is security "best practices" today may not be best practices tomorrow. Some of his example companies are using practices that were "best" 10 years ago. What happens in another 10 years when Troy's current advice is outdated? More pitchforks? Absolutely. To expand on your comment, some of his example companies were using practices that were never secure to begin with. What happens in 10 years when they still aren't being secure at all and more information is in the wild because no one held them accountable? It's best practice for every data-holder to adjust their defenses when any security situation changes, ever, not just Troy's advice. Anything less is just letting laziness rule. (Bring Trump's tweets into this is a total non-sequitur. His 'shaming' has nothing to do with the real world, only his moment to moment delusions.)