3 ms·
Yes, the security team should be fired since they failed in the educational aspects of their job.
by donio 7y ago
Yes, the security team should be fired since they failed in the educational aspects of their job.
- toomuchtodo 7y agoWe still issue speeding tickets instead of firing everyone at the DMV. Educate all you want; no consequences, no behavior change. Incentives matter. Employee opsec metrics should be a part of corporate cybersecurity insurance pricing IMHO.
- jawns 7y agoThis is a good point, and I think there are parallels to other areas of the industry. For instance, let's say I'm a junior developer and I'm told that merging code that fails a suite of unit tests is a serious offense. If I one day forget to run the test suite and merge code that breaks stuff ... it might be my fault at an acute level. But at an organizational level, someone should be saying, "If it's that important to not merge code that breaks tests ... then we should change our process so you _cannot_ merge code until all tests have passed." And if nobody gets faulted at the organizational level, then the junior dev is really just a scapegoat.