3 ms·

> More than three-quarters of IT executives worry that data sprawl puts their data at risk, especially with employees working from insecure home networks, surve

> More than three-quarters of IT executives worry that data sprawl puts their data at risk, especially with employees working from insecure home networks, survey finds. I assumed that security-minded IT departments treated their networks as untrusted. I.e., that most of the security comes from secure hosts + secure point-to-point communications. And therefore running on a public or home network doesn't add much risk.

dcolkitt 6y ago
I think the sad reality is that most corporate IT executives are more interested in security theater than actual security.
- TeMPOraL 6y ago
  Yup. This follows from the way corporations look at IT security. The two main things they care about are: - Compliance - because they need to tick checkboxes to get certifications, get contracts, and minimize liability; - Annualized expected losses - which they estimate by a process only slightly better than reading tea leaves, and then minimize by turning whatever knobs were identified as most impactful in the divination process. The assumption here is that in a large enough enterprise, breaches and outages are a fact of life - so the question is how much it'll cost and how to minimize that number. Source: I worked for a company building the product that automates the reading of tea leaves part. What I've learned is that the quality of risk estimates depends primarily on how diligent the people doing them are, and how good understanding of statistics they have - which is about the worst combination of requirements for busy executives.
ArchOversight 6y ago
Most corporations still treat anyone that is on their "corporate network" as trusted. VPN being used for remote workers generally, but endpoints are not well protected at all, and you still gain access to various resources just by virtue of having the right IP address and being able to route to something. As a security engineer trying to get companies to invest more in Zero Trust type technologies where endpoints aren't necessarily trusted just because they have the right IP, it's difficult to get that mindset to change.
deleted 6y ago
[deleted]
satya71 6y ago
Corporate IT is treated as a cost-center, not a productivity enabler and risk-mitigation center.

dcolkitt 6y ago

I think the sad reality is that most corporate IT executives are more interested in security theater than actual security.

TeMPOraL 6y ago
Yup. This follows from the way corporations look at IT security. The two main things they care about are: - Compliance - because they need to tick checkboxes to get certifications, get contracts, and minimize liability; - Annualized expected losses - which they estimate by a process only slightly better than reading tea leaves, and then minimize by turning whatever knobs were identified as most impactful in the divination process. The assumption here is that in a large enough enterprise, breaches and outages are a fact of life - so the question is how much it'll cost and how to minimize that number. Source: I worked for a company building the product that automates the reading of tea leaves part. What I've learned is that the quality of risk estimates depends primarily on how diligent the people doing them are, and how good understanding of statistics they have - which is about the worst combination of requirements for busy executives.

ArchOversight 6y ago

Most corporations still treat anyone that is on their "corporate network" as trusted. VPN being used for remote workers generally, but endpoints are not well protected at all, and you still gain access to various resources just by virtue of having the right IP address and being able to route to something. As a security engineer trying to get companies to invest more in Zero Trust type technologies where endpoints aren't necessarily trusted just because they have the right IP, it's difficult to get that mindset to change.

deleted 6y ago

[deleted]

satya71 6y ago

Corporate IT is treated as a cost-center, not a productivity enabler and risk-mitigation center.