4 ms·

I'm not disagreeing that it's important. I'm asking, in a corporate environment driven by capitalism and the ultimate pursuit of generating revenue/shareholder

I'm not disagreeing that it's important. I'm asking, in a corporate environment driven by capitalism and the ultimate pursuit of generating revenue/shareholder value. Why would a company care? I know that I've seen situations where departments critical to this access control policy system were chronically understaffed, because they are cost centers. They don't generate value. In the same way I've heard security and access control dissuaded from software development, because "we just need to get this out". What all of these situations end up with is "performative" access control. You have to act as though you need the data, but beyond that it's a free for all. This lets the company pretend like it's fulfilling it's obligations, while saving money.

Spooky23 7y ago
Easy. Risk. Where does the magical privilege end? Who is responsible when the all-seeing CEO is compromised personally and data or cash is exfiltrated? A common fraud committed against public institutions like school districts or small businesses is compromise of a business manager’s account, which allows an attacker to empty the checking account. In a public company, that sort of fraud for finance is mostly controlled by regulatory compliance. But as we know, information or data has value. Value as a commodity, value as a competitive advantage, etc.