3 ms·

The vast majority of business decisions I've seen around security have boiled down to "we need to be able to put something on this sheet/slide, and it needs to

by asark 7y ago

The vast majority of business decisions I've seen around security have boiled down to "we need to be able to put something on this sheet/slide, and it needs to be something that will raise the fewest questions—so, exactly what everyone else does". Effectiveness or actual purpose isn't on the radar, and improving security through these processes does happen but is basically a side-effect or an accident. Some of these things probably are based in some real need (at whichever business started the ball rolling) and tend to be useful for that reason, but I guarantee a lot are just doing things for the sake of being able to say something was done after an incident, get that in place at a couple bigcos and pretty soon it's a standard industry practice, even if it's not sensible at many places implementing it. This smells very much like one of those.

deleted 7y ago
[deleted]
manigandham 7y ago
This is not about security, it's HR. These policies are for mitigating potential risky behavior, not to stop otherwise malicious actors. It's about managing normal workers during a time period that will have decreased or even negative productivity and can cause team cohesion issues. For example: a salesperson wont work on new deals and may even sabotage existing deals that they know they can pick up at a new company. Sometimes it's as innocuous as copying their contacts or browsing through new deal flow which they don't need to know about if they're going to a competitor. A manager might stop getting reports from their team or put off other tasks. Sure it may all go well but there are still hundreds of reasons to avoid all this potential risk. HR departments aren't stupid or useless. They exist to manage the most complicated part of any business: the people. If you haven't ever worked in these sectors or departments, I'd recommend against assuming they have no value.
- asark 7y ago
  I don't assume they have no value. And this general sort of decision-making happens all over in companies (and the public sector) all the time. It's not limited to any particular department, it's just a little more checklisty and cargo-culty in the security world (and I would expect in HR where it concerns procedures like this). [EDIT] to provide some context, I've come to see a huge portion of decisions about policies, procedures, tools, and more as basically personal and departmental risk mitigation and blame-deflection rather than anything aimed at helping a business function. At a high level that's the goal, but in the details it becomes about making sure there's always something or someone to point a finger at. Conveniently these things don't always need to be directly relevant or useful, so long as something's being done and can be put on a powerpoint slide when the C-suite or someone at some company yours is courting asks a question. As long as "what are we doing about X?" can be answered with "Y and Z, both of which are standard industry practices, see this HBR article about how IBM does it" you're good.

by asark 7y ago

deleted 7y ago

[deleted]

manigandham 7y ago

This is not about security, it's HR. These policies are for mitigating potential risky behavior, not to stop otherwise malicious actors. It's about managing normal workers during a time period that will have decreased or even negative productivity and can cause team cohesion issues. For example: a salesperson wont work on new deals and may even sabotage existing deals that they know they can pick up at a new company. Sometimes it's as innocuous as copying their contacts or browsing through new deal flow which they don't need to know about if they're going to a competitor. A manager might stop getting reports from their team or put off other tasks. Sure it may all go well but there are still hundreds of reasons to avoid all this potential risk. HR departments aren't stupid or useless. They exist to manage the most complicated part of any business: the people. If you haven't ever worked in these sectors or departments, I'd recommend against assuming they have no value.

asark 7y ago
I don't assume they have no value. And this general sort of decision-making happens all over in companies (and the public sector) all the time. It's not limited to any particular department, it's just a little more checklisty and cargo-culty in the security world (and I would expect in HR where it concerns procedures like this). [EDIT] to provide some context, I've come to see a huge portion of decisions about policies, procedures, tools, and more as basically personal and departmental risk mitigation and blame-deflection rather than anything aimed at helping a business function. At a high level that's the goal, but in the details it becomes about making sure there's always something or someone to point a finger at. Conveniently these things don't always need to be directly relevant or useful, so long as something's being done and can be put on a powerpoint slide when the C-suite or someone at some company yours is courting asks a question. As long as "what are we doing about X?" can be answered with "Y and Z, both of which are standard industry practices, see this HBR article about how IBM does it" you're good.