4 ms·
there are standards and operating procedures that can be used. it’s not that hard. it comes down to training and cost cutting. If the penalty for failing miser
by rantwasp 5y ago
there are standards and operating procedures that can be used. it’s not that hard.
it comes down to training and cost cutting. If the penalty for failing miserably is 0 you won’t see any change. I would hold the companies responsible for things like this liable to the point they would be put out of business after an event like this. If the cost of being sloppy is that you no longer have a business people will start paying attention really quickly.
- wyager 5y ago> there are standards and operating procedures that can be used 99% of these standards are completely useless and exist only to reduce legal liability. The other 1% are only incidentally slightly useful. You will never ever create a secure company by following some stupid checklist, unless the checklist is so extreme as to be useless to most orgs. “Step 1: only run OpenBSD…”
- rantwasp 5y agoa checklist is not where it begins, but it is where it starts. if you don’t have it you probably don’t know what you’re doing
- wyager 5y agoThis is almost the exact opposite of the truth. People who know what they’re doing don’t blindly follow some checklist. Doing this properly requires deliberation, or an implausibly large decision tree.
- rantwasp 5y agoi disagree. having a set of rules and a domain expert that defines those rules is key. automation around enforcement and designing the system to make it as less painful as possible are also key. you cannot just say: oh this is so complicated that we cannot possibly have a system for it and we have to rely on the people to do the “right thing”