3 ms·
A starting point would be to have a dedicated team perform steps 1-3 as a service to all teams, individual teams become responsible for steps 4-6, and managemen
by aahortwwy 5y ago
A starting point would be to have a dedicated team perform steps 1-3 as a service to all teams, individual teams become responsible for steps 4-6, and management assume responsibility for step 7 as well as overall goal setting (e.g. deciding by how much they want all teams to reduce/mitigate their risk over the coming epoch).
- ryanbrunner 5y agoThis definitely presumes a certain company size. The company I work for has 5 employees (2 in an engineering capacity), there's zero room for dedicated teams for anything. I've found even in a 100 person startup there's probably appetite for 1, MAYBE 2 people who are 100% dedicated to security.
- aahortwwy 5y agoWell sure, the comment that I replied to specifically asked how you might apply the heuristic in a larger organization. With just a handful of people it can be applied by one security-conscious member of the team, and at that scale it's also viable to get everyone on board with applying it consistently.