I'm feeling a bit cynical, and I wonder if this will bring real changes? I happen to have a good friend at ReliaQuest, so I know that, after the data theft, Equ

I'm feeling a bit cynical, and I wonder if this will bring real changes? I happen to have a good friend at ReliaQuest, so I know that, after the data theft, Equifax hired ReliaQuest, and has slowly expanded that contract, giving more and more responsibility to ReliaQuest. My friend is an awesome engineer and ReliaQuest is a very good outfit, but still, I'm frustrated by the idea that the CEO of Equifax can simply outsource security and then not think about it any more. For companies that hold people's most sensitive data, I'd like the top person to be obsessed with security 24 hours a day. I wrote about this previously: "If a company handles people’s sensitive financial data, then I would like the CEO to be the type of person who wakes up in the morning thinking about security, goes to sleep at night thinking about security, and never has security far from their mind during the day. So to hire a security company, and then act as if security is a solved problem, is troubling. There are many other ways for a company to be hacked. Social engineering is a danger, and most company hacks are inside jobs. Hiring a firm such as ReliaQuest does not protect you from having one of your own employees steal data and sell it to the Russians. Protecting against internal attacks requires hard thinking by the top leadership of the company. The job can not be outsourced." http://www.smashcompany.com/business/if-a-company-is-serious-about-security-then-who-in-the-company-is-serious-about-security http://www.smashcompany.com/business/if-a-company-is-serious...