3 ms·

while i appreciate the insights you bring to bear on the actual behavior of organizations and teams, your response seems to be resigned to accepting the status

while i appreciate the insights you bring to bear on the actual behavior of organizations and teams, your response seems to be resigned to accepting the status quo rather than working to change the incentives so that security risks and damages are internalized appropriately. this kind of excuse-making is how we slide down various slippery slopes (e.g., how google's "don't be evil" eventually failed), even with eyes wide open. instead, the better response is to advocate legislative and organizational improvements while also working within your perceived constraints. it can be both, not either-or.

motohagiography 6y ago
This comment expresses a misunderstanding. Merely not believing hard enough is not why threat modelling has failed. There is an incentive mechanism and this description of it can help them re-orient their strategy. The counterfactual premise of threat modelling is that a business wants responsibility for mitigating or remediating risk without direct compensation, instead of a method to manage and transfer it. A technologist is just happy to solve problems, so they don't see this open loop as a source of value.