3 ms·

In current times given the proliferation of technology in every business and our daily life, it will be hard for any company to say they are not an IT company.

In current times given the proliferation of technology in every business and our daily life, it will be hard for any company to say they are not an IT company. But it will require a fundamental change in thinking for many companies to move the mindset from IT being a support to one of the core competency in the company. Indeed they need to treat it like their core business and if necessary hire the services of ethical hacker to make sure they are prepared for the disaster and can survive. But its easier said than done, most fortune 500 will still prefer to pay 5 or 6 digit sums to consultant to design a security instead of hiring ethical hacking services, to make sure in case of attack their processes and systems work. Indeed they hire the services of the same IT outsourcing service provider to design the security, who themselves are a target. Most of this IT outsourcing company including IBM and Accenture are cost arbitrage firms providing manpower at a cost which is higher than the cost of that consultant. So except security by obscurity, I doubt they will be able to build a robust system or process to survive an attack. Except big tech companies like Google, Apple, Microsoft or Facebook most are not having programs for bounty hunting or security audits. Hopefully other companies also have such programs in place with openness and transparency.

C1sc0cat 7y ago
They need to do both !
close04 7y ago
> consultant to design a security instead of hiring ethical hacking services One does not exclude the other. And also consider that even the best security practices are not guaranteeing anything. Hackers can afford to fail 1000 times. The company only has to fail once.
- dragonsh 7y ago
  An ethical hacker will bring down the systems. Indeed I believe that whatever security is in place there is a possibility of a hack. So by using ethical hacker you let the whole system die and see if company can recover or continue either with disaster recovery or paper based process or combination of multiple strategy. This is what I meant by ethical hacking service. Based on practical experience with the top consulting firms can say confidently besides security by obscurity and security practice which is a copy paste of some pre-defined strategy by so called their experts, almost none employ or pay ethical hackers to bring down their own security or process to show that their strategy works.
  - close04 7y ago
    > you let the whole system die and see if company can recover or continue either with disaster recovery or paper based process or combination of multiple strategy. You're not describing a security breach scenario here but basically a disaster scenario. It's security vs. resiliency. I mean there are plenty of threat models to protect from, hackers trying to steal secrets, hackers trying to take down your systems, etc. But in the end security is about making sure you detect and/or stop the attacker, other processes take care of rebuilding after they took you down. So you wouldn't hire an ethical hacker to take down your systems but rather to identify weak points, exploit them, infiltrate the system and then possibly exfiltrate data. The aftermath of what the hacker did is something else entirely and will be dealt by your disaster recovery, business continuity processes, PR, etc.
AtlasBarfed 7y ago
All companies being IT companies was true about 30 years ago, although I agree it becomes more pronounced every year. If an MBA program only requires accounting/finance and doesn't require IT management at some basic level should get it decredited.

C1sc0cat 7y ago

They need to do both !

close04 7y ago

> consultant to design a security instead of hiring ethical hacking services One does not exclude the other. And also consider that even the best security practices are not guaranteeing anything. Hackers can afford to fail 1000 times. The company only has to fail once.

dragonsh 7y ago
An ethical hacker will bring down the systems. Indeed I believe that whatever security is in place there is a possibility of a hack. So by using ethical hacker you let the whole system die and see if company can recover or continue either with disaster recovery or paper based process or combination of multiple strategy. This is what I meant by ethical hacking service. Based on practical experience with the top consulting firms can say confidently besides security by obscurity and security practice which is a copy paste of some pre-defined strategy by so called their experts, almost none employ or pay ethical hackers to bring down their own security or process to show that their strategy works.
- close04 7y ago
  > you let the whole system die and see if company can recover or continue either with disaster recovery or paper based process or combination of multiple strategy. You're not describing a security breach scenario here but basically a disaster scenario. It's security vs. resiliency. I mean there are plenty of threat models to protect from, hackers trying to steal secrets, hackers trying to take down your systems, etc. But in the end security is about making sure you detect and/or stop the attacker, other processes take care of rebuilding after they took you down. So you wouldn't hire an ethical hacker to take down your systems but rather to identify weak points, exploit them, infiltrate the system and then possibly exfiltrate data. The aftermath of what the hacker did is something else entirely and will be dealt by your disaster recovery, business continuity processes, PR, etc.

AtlasBarfed 7y ago

All companies being IT companies was true about 30 years ago, although I agree it becomes more pronounced every year. If an MBA program only requires accounting/finance and doesn't require IT management at some basic level should get it decredited.