3 ms·
I think the sad reality is that most corporate IT executives are more interested in security theater than actual security.
by dcolkitt 6y ago
I think the sad reality is that most corporate IT executives are more interested in security theater than actual security.
- TeMPOraL 6y agoYup. This follows from the way corporations look at IT security. The two main things they care about are: - Compliance - because they need to tick checkboxes to get certifications, get contracts, and minimize liability; - Annualized expected losses - which they estimate by a process only slightly better than reading tea leaves, and then minimize by turning whatever knobs were identified as most impactful in the divination process. The assumption here is that in a large enough enterprise, breaches and outages are a fact of life - so the question is how much it'll cost and how to minimize that number. Source: I worked for a company building the product that automates the reading of tea leaves part. What I've learned is that the quality of risk estimates depends primarily on how diligent the people doing them are, and how good understanding of statistics they have - which is about the worst combination of requirements for busy executives.