4 ms·

Literally all of them. Security is a cost center, and non bureaucrats salaries are minimized as much as possible until you are left with "warm body to fill chai

Literally all of them. Security is a cost center, and non bureaucrats salaries are minimized as much as possible until you are left with "warm body to fill chair". Even the NSA doesn't pay well, compared to private sector.

milkytron 5y ago
The gap between the security and defense seems to be becoming smaller. If some of the defense budget was put towards cyber defense, I bet we could see some drastic improvements.
MeinBlutIstBlau 5y ago
I'm wholly aware the private sector pays better, but in the grand scheme of pay/average citizen, they still make decent salaries. In that regard, why is upper management ignoring IT security at a base-line level of at least rotating backups? Like even that is pretty cheap and you can revert systems back within a day or two with a few days of lost work. Nobody is saying have a top tier security team.
- hn8788 5y ago
  I was on a temporary pentesting contract at a Fortune 500 company, and the reason for ignoring security came down to cost. Our contact in their IT department said that when they were trying to get the budget to fix their longstanding security issues, they were told that it's cheaper to accept occasionally getting hacked than it is to fix things. They said that public relations people at big companies had pushed the "the bad guys attacked us, it could have happened to anyone" narrative so well that besides a few day dip in stock prices, there would be no negative financial impact on the company. The average person thinks of getting hacked like being robbed at gunpoint, where it can happen to anyone through no fault of their own.
  - jnwatson 5y ago
    In terms of dollars and cents that makes complete sense. Real security is extraordinarily expensive. Very rarely is that compatible with shareholder value.
ForHackernews 5y ago
> Even the NSA doesn't pay well, compared to private sector. On the other hand, I bet it's pretty fun working for the NSA: https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
- pyuser583 5y ago
  From what little I’ve heard, the NSA is not different from other public sector work.

milkytron 5y ago

The gap between the security and defense seems to be becoming smaller. If some of the defense budget was put towards cyber defense, I bet we could see some drastic improvements.

MeinBlutIstBlau 5y ago

I'm wholly aware the private sector pays better, but in the grand scheme of pay/average citizen, they still make decent salaries. In that regard, why is upper management ignoring IT security at a base-line level of at least rotating backups? Like even that is pretty cheap and you can revert systems back within a day or two with a few days of lost work. Nobody is saying have a top tier security team.

hn8788 5y ago
I was on a temporary pentesting contract at a Fortune 500 company, and the reason for ignoring security came down to cost. Our contact in their IT department said that when they were trying to get the budget to fix their longstanding security issues, they were told that it's cheaper to accept occasionally getting hacked than it is to fix things. They said that public relations people at big companies had pushed the "the bad guys attacked us, it could have happened to anyone" narrative so well that besides a few day dip in stock prices, there would be no negative financial impact on the company. The average person thinks of getting hacked like being robbed at gunpoint, where it can happen to anyone through no fault of their own.
- jnwatson 5y ago
  In terms of dollars and cents that makes complete sense. Real security is extraordinarily expensive. Very rarely is that compatible with shareholder value.

ForHackernews 5y ago

> Even the NSA doesn't pay well, compared to private sector. On the other hand, I bet it's pretty fun working for the NSA: https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS

pyuser583 5y ago
From what little I’ve heard, the NSA is not different from other public sector work.