3 ms·
I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it
by anticristi 6y ago
I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it will finally be seen as a feature to keep the CEO out of jail.
- kevmo 6y agoProbably 2/3 of billionaires belong in jail.
- aloisdg 6y agoProbably most of them if not all.
- Judgmentality 6y ago"Behind every great fortune is a crime."
- hunter-gatherer 6y agoThis is just it. I also work in the security industry, and the fact of the matter is that we (security professionals) can't give guarantees. I don't know what exotic exploit or bug will exist tomorrow. Security professions basically offer what (to me) seems like a crappy insurance policy. Depending on your orgs threat model, it is often just cheaper to deal with the breaches. --- I am not saying facebook falls into this category. ---
- anticristi 6y agoSecurity is not a replacement for a data breach insurance. Security is basic hygiene for insurance to work at all. To me, a good parallel is home insurance. If you get robbed, a good insurance will cover your losses. However, if said insurance determines that you were negligent -- say you never lock your front door -- you are on your own. Do you have precious art at home that you want insured? No problem. Just make sure you add an alarm and sprinklers. That is how I want discussions around security to be held. Are you a start-up with 10 users? It's okay to do minimal security. Are you a bank whose wires carry $1B? Make sure you throw sufficient "bodies" at the problem, from the top of the hierarchy to bottom.