3 ms·

I work in the security field and let me tell you something I realized: nobody cares about security. If someone cares about security, it's because they've had ma

I work in the security field and let me tell you something I realized: nobody cares about security. If someone cares about security, it's because they've had many many incidents in the past. We humans are not a species that is good at preventing, we are good at reacting. the security handbook[^1] has a chapter on that actually, and they basically say that role playing is the only way of not getting burned. Humans are excellent at role playing, and it can help you prevent a lot of catastrophe without having experienced them before. [^1]: https://securityhandbook.io/ https://securityhandbook.io/

anticristi 6y ago
I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it will finally be seen as a feature to keep the CEO out of jail.
- kevmo 6y ago
  Probably 2/3 of billionaires belong in jail.
  - aloisdg 6y ago
    Probably most of them if not all.
    - Judgmentality 6y ago
      "Behind every great fortune is a crime."
- hunter-gatherer 6y ago
  This is just it. I also work in the security industry, and the fact of the matter is that we (security professionals) can't give guarantees. I don't know what exotic exploit or bug will exist tomorrow. Security professions basically offer what (to me) seems like a crappy insurance policy. Depending on your orgs threat model, it is often just cheaper to deal with the breaches. --- I am not saying facebook falls into this category. ---
  - anticristi 6y ago
    Security is not a replacement for a data breach insurance. Security is basic hygiene for insurance to work at all. To me, a good parallel is home insurance. If you get robbed, a good insurance will cover your losses. However, if said insurance determines that you were negligent -- say you never lock your front door -- you are on your own. Do you have precious art at home that you want insured? No problem. Just make sure you add an alarm and sprinklers. That is how I want discussions around security to be held. Are you a start-up with 10 users? It's okay to do minimal security. Are you a bank whose wires carry $1B? Make sure you throw sufficient "bodies" at the problem, from the top of the hierarchy to bottom.
RachelF 6y ago
The problem is that companies don't care about securing their data, because the data is not theirs, it is about their users. Mark Zuckerberg probably spends more on personal and family security and privacy than Facebook spends on their users' security.
PietKachelhout 6y ago
That site is a scam. The listed email address does not exist and I have not received a book.

anticristi 6y ago

I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it will finally be seen as a feature to keep the CEO out of jail.

kevmo 6y ago
Probably 2/3 of billionaires belong in jail.
- aloisdg 6y ago
  Probably most of them if not all.
  - Judgmentality 6y ago
    "Behind every great fortune is a crime."
hunter-gatherer 6y ago
This is just it. I also work in the security industry, and the fact of the matter is that we (security professionals) can't give guarantees. I don't know what exotic exploit or bug will exist tomorrow. Security professions basically offer what (to me) seems like a crappy insurance policy. Depending on your orgs threat model, it is often just cheaper to deal with the breaches. --- I am not saying facebook falls into this category. ---
- anticristi 6y ago
  Security is not a replacement for a data breach insurance. Security is basic hygiene for insurance to work at all. To me, a good parallel is home insurance. If you get robbed, a good insurance will cover your losses. However, if said insurance determines that you were negligent -- say you never lock your front door -- you are on your own. Do you have precious art at home that you want insured? No problem. Just make sure you add an alarm and sprinklers. That is how I want discussions around security to be held. Are you a start-up with 10 users? It's okay to do minimal security. Are you a bank whose wires carry $1B? Make sure you throw sufficient "bodies" at the problem, from the top of the hierarchy to bottom.

RachelF 6y ago

The problem is that companies don't care about securing their data, because the data is not theirs, it is about their users. Mark Zuckerberg probably spends more on personal and family security and privacy than Facebook spends on their users' security.

PietKachelhout 6y ago

That site is a scam. The listed email address does not exist and I have not received a book.