4 ms·

Something that I’ve seen as a root to a lot of problems and inertia at big co IT is that theres been a couple of cycles where people where internally recruited

Something that I’ve seen as a root to a lot of problems and inertia at big co IT is that theres been a couple of cycles where people where internally recruited from business to IT - the mainframe era and more recently the client/server era. Nothing wrong with recruiting internally per-se, it’s more about the fact that many lacked basic knowledge. I’m painting with a big brush here, but I’ve seen effects of this throughout my so called career. - 40 years ago career-paths was opened as cobol programmers. Knowledge was scarce and security was in many ways non-existing. - 20 years ago guys got shifted to IT because they knew how to fix the printer. Client/server knowledge was scarce and security non-existing. You breed a segment of IT workers, many which are in ways clueless, but it’s big business. It’s enterprise IT. Massive breaches, slow to change, and downtime by the buckets. Tickets churning along in “automated” workflows. Queue the outsourcing strategies! Might seem a sane choice considering the above - only... it’s difficulty to outsource something you’re not in control of. This obvious lack of control have led to the ITSM field with it’s CABs, ITILs and other acronyms, all designed to lull everyone into a false sense of security. I could go on, perhaps write a book. Anyway, I totally agree with what you’re saying, just wanted to share my perspective.

HenryBemis 7y ago
And this is why IT Audit and IT Security came forward, because IT staff (1st line) will do IT stuff and won't take into account design effectiveness, operating effectiveness for controls/processes. IT Risk (2nd line) is mostly non-IT people that try to convince IT people "what is right". That never works. One of the advantages I have when I work for the 2nd line, is that I've been the 1st line and I know the shit the IT staff have to deal with, and I don't pretent I know better, I do know (((EDIT: I do know exactly what they go through because I've gone through that myself))). And my "risk mitigation advice" is actual, tangible, and with real examples. There is also the 3rd line (internal audit) that in most orgs they completely miss the mark. ZERO IT knowledge, probably former Big4 that have never seen a console in their lives, wearing a police hat barking orders. No wonder that the IT landscape is suffering. I also understand that COO/CEOs don't allow CIO-CTOs the time to have a freeze period, STOP running forward and give them the time to pause, breathe, think, repair. You can't be making and perfecting at the same time. Nobody has the resources for that, so it's all accidents waiting to happen. I'm not fearmongering, I've just seen enough crap on IT systems (mainly on LARGE corporations) that have made my skin crawl..
- jordanbeiber 7y ago
  In my experience the auditors and sec guys are bred in the same enterprise factory. “Let’s just buy and implement yet another indispensible enterprise tool and we will _finally_ be in control!” There’s one thing, and one thing only that allows the speed business want and enable the security and audit required - it’s called automation. Nothing beats competence coupled with automation. Let’s use the machines that was invented and built for automation to actually automate stuff! Ok, Enterprise IT?!

HenryBemis 7y ago

And this is why IT Audit and IT Security came forward, because IT staff (1st line) will do IT stuff and won't take into account design effectiveness, operating effectiveness for controls/processes. IT Risk (2nd line) is mostly non-IT people that try to convince IT people "what is right". That never works. One of the advantages I have when I work for the 2nd line, is that I've been the 1st line and I know the shit the IT staff have to deal with, and I don't pretent I know better, I do know (((EDIT: I do know exactly what they go through because I've gone through that myself))). And my "risk mitigation advice" is actual, tangible, and with real examples. There is also the 3rd line (internal audit) that in most orgs they completely miss the mark. ZERO IT knowledge, probably former Big4 that have never seen a console in their lives, wearing a police hat barking orders. No wonder that the IT landscape is suffering. I also understand that COO/CEOs don't allow CIO-CTOs the time to have a freeze period, STOP running forward and give them the time to pause, breathe, think, repair. You can't be making and perfecting at the same time. Nobody has the resources for that, so it's all accidents waiting to happen. I'm not fearmongering, I've just seen enough crap on IT systems (mainly on LARGE corporations) that have made my skin crawl..

jordanbeiber 7y ago
In my experience the auditors and sec guys are bred in the same enterprise factory. “Let’s just buy and implement yet another indispensible enterprise tool and we will _finally_ be in control!” There’s one thing, and one thing only that allows the speed business want and enable the security and audit required - it’s called automation. Nothing beats competence coupled with automation. Let’s use the machines that was invented and built for automation to actually automate stuff! Ok, Enterprise IT?!