> an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec Because they're n

> an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec Because they're not listening when we tell them to not roll their own crypto! Or in a more serious tone: organisations often ignore best current practices, even after they spent a lot of money to have us look at their work and we told them what mistakes we found. Maybe we should indeed work more on making it easier to do things right, rather than just telling them how to do it right. It feels a bit like how you can at least distribute free needles to avoid infectious diseases when you can't stop people from being addicted to drugs. Although if you look at pure research (not just advice not being followed), the gap indeed gets even bigger. Things like formal verification is great for academics but what would really help organisations is robust append-only, easy-to-restore backups to recover without paying after their stuff got encrypted again. But that's not sexy clever research, that's just some plumbing. While that sort of plumbing is not typically considered our job as security testers, it would be a solution that can make a real difference when looking at the attacks being done. (Criminals can still try blackmailing, but that seems to be much less lucrative on average, and good backups are also useful for accidental data destruction.)