3 ms·
This explanation has a lot of good reasons, but is missing an important one - the value proposition of cyber security. Decisions makers (assuming informed) wil
by bottled_poe 6y ago
This explanation has a lot of good reasons, but is missing an important one - the value proposition of cyber security. Decisions makers (assuming informed) will make an assessment of risk vs cost. Absolute cyber security is rarely a relevant consideration. The assessment is always going to be (at best) an evaluation of investment in cyber security vs risk of greater costs (in the form of compromised security, organisational changes, etc). We need to understand that these decisions are not made from a purely technical perspective. Real costs exist and decision-makers will (rightly) always compare those costs against the estimated benefits.
- dreamcompiler 6y agoAnd because it's an expenditure that only hypothetically might decrease a larger expenditure in the future, many managers will decide to do only the minimum necessary to check the compliance boxes. Another problem is that when the security systems get in the way of expediency, there's always somebody around who can disable or severely cripple the security to make it easy for people to e.g. work from home during a pandemic.
- bottled_poe 6y agoI think the economics of cyber security are poorly modelled/understood at present. I’m of the opinion that building a slightly higher wall than a similar target is generally sufficient (as an economic deterrent) vs most enemies. However, this is a simplistic model and doesn’t account for targeted attacks. It’s a complex problem space and has a lot of room to mature. I expect great changes in this space over the coming years.