4 ms·
A nice bumper sticker slogan... Indeed there are perceived no-win scenarios for which you can cheat or redefine the rules somehow or even redefine what winning
by badrabbit 7y ago
A nice bumper sticker slogan... Indeed there are perceived no-win scenarios for which you can cheat or redefine the rules somehow or even redefine what winning means. In my opinion (and many others' as well) you can't lead anyone if you don't know how to lose right.
Death is a perfect example. Especially preventable death of a child. You can't even grieve properly if you can't accept loss.
But let's talk about infosec, the entired discipline of incident response is founded on the expectation of security incident,as in security in some way was compromised or reduced. The whole point is to lose well! As in you responded well so the loss in security was minimized. You still lost because your attacker was able to get past your defenses and reduce security. Or perhaps one might say it is only a loss if confidentiality of data was breached. Ok, you did everything right and due to human error 0day exploits that abused attack vectors outside your threat model, your crown jewels were lost. What then? If you accept loss, you communicatr the data breach effectively, follow your plan for such a no-win situation. You simply can't lose right if you can't accept loss and losing right is not winning. You lost what was important to you,that process cannot be reversed and it was not preventable.
I think as a philosophy murphy's law gives a better perspective.
- dogma1138 7y agoYou limit your example to a perfect world scenario in which IR is the only reactionary discipline. If you want to see just how much Kirk was right look at any major breach and how companies react to it for example the Equifax beach. Yeah their IR team might have dealt with the no-win scenario as you mention, but their senior management Kirked the hell out of it by selling stock shortly after the breach was discovered to ensure they don’t their fortune and then the corporate machine was set into play to ensure that the company gets mostly unscathed from the entire ordeal. So IR did their job, they fell on their swords and what not, but the execs, the lawyers, lobbyists an the PR folks just shrugged and said that’s nice let us show you how it’s really done.
- badrabbit 7y agoI don't get what you are saying. Infosec teams are part of the company, if they choose to capitalize on a breach, good for them. They still lost, like i said earlier, making the best out of a loss does not change the fact that there was a loss. Their brand reputation will always be inferior because of this. They accepted loss so they tried to lose well. Not accepting loss would be to not be prepared because your security is too good or to refuse to disclose the public because of consequences right?