3 ms·

Your whole post both misses the point of this site and misses the blame for the points you raise. > How about suggesting some solutions? Why not contact the m

Your whole post both misses the point of this site and misses the blame for the points you raise. > How about suggesting some solutions? Why not contact the makers of the site and ask them? It's pretty clear they made this website for a little bit of marketing for a security training vendor: > Reflare is an IT Security training company helping executives and IT professionals create more secure organizations. My personal $0.02 is to look at what Salesforce did. They hired pen testers to hack their board members and to reveal to each of them their most personal / valuable / embarrassing data. That breaks the ice and loosens the purse strings. Spend on a security team like a financial institution would. Then the entire company institutes "distributed security": gamification mechanics applied to all aspects of security. Incentivize _every_ _single_ _employee_ and contractor to be involved in security. Give out quarterly tropical vacataions to _any_ employee which improves company security the most. Train them -- every single hire. Compartmentalize + least privilege. > Haha they hired a CISSP,how lame The site randomly picks from an array of mitigations: * made everyone promise to be super super careful * gotten ISO certified * gotten PCI certified - worked with industry leading specialists - upskilled our cafeteria staff - hired external consultants - worked with law enforcement - bought an IDS - twiddled with our firewall - been pretty good about security - hired some people with 'CISSP' after their names - watched a YouTube video on cyber security - told them to not do it again - said that we are very sorry - copy-pasted a security policy we found on Google - hired a Russian dude - watched the movie Hackers 8 times back to back - sent one of our guys to Defcon - put a rotating lock GIF on our website Hiring a CISSP doesn't seem as ridiculous as the other options, but all things considered, I would rather a company hire CISSPs before they get breached. If they do it only after they get breached, I'd rather the company go bankrupt as a lesson the competition. I'm 100% in support of this website poking at Equifax because the post-breach repercussions have been far too lenient on the company and I hope every company fears bing "the next Equifax". > Management and C-suite do not get clear,useful and actionable security risk analysis Management and the C-Suite exist to hire the team that can give them the information + performance they want. It sounds like the C-Suite needs to learn what they don't know and then hire a CIO+CISO. In the end, there is a risk trade-off. Far too many companies just "accept the risk" or simply buy cyber insurance (rather than investing in risk mitigations) then get breached. Far too few companies get liquidated when they get breached, sending a bad signal to their competition. Most companies don't want to lock down their product to absolute minimum risk (because that is fantastically expensive) and just aim to spend "the industry average" on security.

badrabbit 7y ago
Money is hardly the problem,justifyin spending is. Same goes for hiring, lack of people who know enough to be a general practitioner or architect is the problem not spending. > It sounds like the C-Suite needs to learn what they don't know and then hire a CIO+CISO. How???? You don't know what you don't know and you can only spend so much. A CISO that knows infosec is not easy to find. Like i said in my comment what companies do is based on incentives. If you believe they should be more liable then get laws passed and their risk assesment will justify the spend. Truth be told financial and reputation loss are the only concerns for a business,why is that surprising? They should be more responsible? Yeah...that's not how capitalism works, IT is an expense that you make up for using your revenue sources,doesn't pay for itself directly. You want them to spend 1M/year on a decent CISO and 200k+ on a team of security experts? Imagine how silly that would be for most companies with less than 5k employees! Give them a legal incentive and make security better using other avenues such as better IT products and services (which many are doing) Oh and about salesforce...their main business is IT! They have quite a sizable revenue and a breach would affect that precious revenue very significantly. As opposed to say...home depot,99% of their customers who don't work in IT never even heard of their breach,heck I meet people in infosec who haven't either and they shop at homedepot just fine. Also,when a lot of companies are breached their stock either remains unaffected or it actually goes up because the breach is PR! To me the whole thread and site is showing me the scale of the infosec bubble/echochamber. Too bad for karma though :)

badrabbit 7y ago

Money is hardly the problem,justifyin spending is. Same goes for hiring, lack of people who know enough to be a general practitioner or architect is the problem not spending. > It sounds like the C-Suite needs to learn what they don't know and then hire a CIO+CISO. How???? You don't know what you don't know and you can only spend so much. A CISO that knows infosec is not easy to find. Like i said in my comment what companies do is based on incentives. If you believe they should be more liable then get laws passed and their risk assesment will justify the spend. Truth be told financial and reputation loss are the only concerns for a business,why is that surprising? They should be more responsible? Yeah...that's not how capitalism works, IT is an expense that you make up for using your revenue sources,doesn't pay for itself directly. You want them to spend 1M/year on a decent CISO and 200k+ on a team of security experts? Imagine how silly that would be for most companies with less than 5k employees! Give them a legal incentive and make security better using other avenues such as better IT products and services (which many are doing) Oh and about salesforce...their main business is IT! They have quite a sizable revenue and a breach would affect that precious revenue very significantly. As opposed to say...home depot,99% of their customers who don't work in IT never even heard of their breach,heck I meet people in infosec who haven't either and they shop at homedepot just fine. Also,when a lot of companies are breached their stock either remains unaffected or it actually goes up because the breach is PR! To me the whole thread and site is showing me the scale of the infosec bubble/echochamber. Too bad for karma though :)