4 ms·

Having worked with some financial institutions, I can assure you it's often the same orgs that spend bazillions on extra-super-secure hardware etc and then leav

Having worked with some financial institutions, I can assure you it's often the same orgs that spend bazillions on extra-super-secure hardware etc and then leave security holes large enough to drive trucks through elsewhere. In short, if you make the process to do things the Right Way hard enough, people will just circumvent the process.

qz2 6y ago
It's even worse than that from experience. Most of these financial institutions had terrible practices before and the surface area of their terrible practices is huge and mostly unknown. So when they go and apply some new super secure process or audit they don't actually apply it across their entire estate or the organisation is so thoroughly compartmentalised that it's impossible to get everyone to align with the goals of the audit. The only outcome is what they call a partial success but I call a complete failure.
jtwaleson 6y ago
That wording is brilliant. I struggle with this a lot in a regulated industry. Everyone wants to do The Right Thing, but doing it "The Right Way" and documenting accordingly is so much work!
- 542354234235 6y ago
  Also, the people in charge just putting all the onus on individual operators. That they will jump through all those hoops because it is “the right way” so of course they will do it. Well, news flash. A lot of people don’t and if you have a security breach, its cold comfort that it was because someone took a shortcut on step 438 of your pointlessly difficult process. Imagine if airline safety operated that way. “Well, it is up to the pilot to make sure they pay attention and keep up with their training. They will do it because it is the right way.” No, they look at how can they make it impossible to do the wrong thing. How can they make this alarm impossible to ignore? In this very specific scenario, is it possible for this problem to go unnoticed or undetected? How can we train pilots and ensure they understand in a real world situation? Etc. Which is the right model, in my opinion. It isn’t “on paper, does this technically solve the problem” it is “regardless of user error or equipment failure, will this still solve the problem”.
whazor 6y ago
Which makes sense, you have big security teams with the job to do security stuff. Then you have software and business teams who trying to meet certain targets, where security is normally an afterthought.

qz2 6y ago

It's even worse than that from experience. Most of these financial institutions had terrible practices before and the surface area of their terrible practices is huge and mostly unknown. So when they go and apply some new super secure process or audit they don't actually apply it across their entire estate or the organisation is so thoroughly compartmentalised that it's impossible to get everyone to align with the goals of the audit. The only outcome is what they call a partial success but I call a complete failure.

jtwaleson 6y ago

That wording is brilliant. I struggle with this a lot in a regulated industry. Everyone wants to do The Right Thing, but doing it "The Right Way" and documenting accordingly is so much work!

542354234235 6y ago
Also, the people in charge just putting all the onus on individual operators. That they will jump through all those hoops because it is “the right way” so of course they will do it. Well, news flash. A lot of people don’t and if you have a security breach, its cold comfort that it was because someone took a shortcut on step 438 of your pointlessly difficult process. Imagine if airline safety operated that way. “Well, it is up to the pilot to make sure they pay attention and keep up with their training. They will do it because it is the right way.” No, they look at how can they make it impossible to do the wrong thing. How can they make this alarm impossible to ignore? In this very specific scenario, is it possible for this problem to go unnoticed or undetected? How can we train pilots and ensure they understand in a real world situation? Etc. Which is the right model, in my opinion. It isn’t “on paper, does this technically solve the problem” it is “regardless of user error or equipment failure, will this still solve the problem”.

whazor 6y ago

Which makes sense, you have big security teams with the job to do security stuff. Then you have software and business teams who trying to meet certain targets, where security is normally an afterthought.