When IT leadership talks a big game about security, as a skilled practitioner on the ground I still see plenty of opportunities. When you delve into details, a

When IT leadership talks a big game about security, as a skilled practitioner on the ground I still see plenty of opportunities. When you delve into details, a lot of that “serious business regulated entity with compliance auditing requirements” stuff is brain dead. Like, running vulnerability scanners that don’t even speak the same wire protocols as a the applications under test. Enforcing strict ACLs on UIs while it’s trivial to SSH and curl the backend APIs. I sometimes wonder whether accounting is like this too. Is financial audit just as much of a fig leaf? Can a skilled accountant also spot dozens of ways to embezzle?