2 ms·
People don't seem to realize the financial planning aspect of deciding whether to do rigorous security or not. A major part of training materials for CISSP, whi
by barbecue_sauce 8y ago
People don't seem to realize the financial planning aspect of deciding whether to do rigorous security or not. A major part of training materials for CISSP, which is really more of a security management certification than a technical one, is explicitly about doing a cost-benefit analysis of security implementation. See https://en.wikipedia.org/wiki/Annualized_loss_expectancy https://en.wikipedia.org/wiki/Annualized_loss_expectancy.
That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats.
- idontpost 8y ago> That said, there are fair number of common-sense low or zero cost safeguards any technical employees could implement to help mitigate threats. The cost isn't in the safeguards. The cost is in the governance structures (i.e. time spent by mid-level managers) that ensure the safeguards are followed and applied consistently across the organization. Encrypting database fields is basically free. Making sure all database fields that should be encrypted are is an expensive process.