4 ms·
I genuinely believe that’s a better starting point though. It is absolutely true that everything can be hacked if they try hard enough, so the question is — ho
by pdpi 7y ago
I genuinely believe that’s a better starting point though.
It is absolutely true that everything can be hacked if they try hard enough, so the question is — how hard do they need to try, and what resources do they need?
As you reach an answer to that question, you either consider that level of investment a credible threat you need to worry about (in which case you invest in tightening things up) or you don’t (beers at 5?).
- tinus_hn 7y agoThat is not the defense of ‘I don’t need to improve security because nothing is secure anyway’ though. Or ‘It’s acceptable to keep making the same dumb mistakes over and over because nothing can be secure anyway’.
- pdpi 7y agoYup, agreed. My point is that I find it easier to talk a defeatist into a somewhat proactive security practitioner (everything is hackable but the point is to deter, delay, and mitigate, not outright stop all attacks), but it's a lot harder to talk a security absolutist into backing down because their initiatives are a net negative. Also, the nuanced posture can look like the defeatist attitude if you don't pay attention to the details —and, on the flip side, you need to pay attention to those same details to tell a proactive attitude from security theatre.