IT security isn’t. I work in the public sector and we operate soooo many systems spread out on 876 different departments and around 10.000 employees. We’re sti

IT security isn’t. I work in the public sector and we operate soooo many systems spread out on 876 different departments and around 10.000 employees. We’re still achieving our NSIS certification. Not because we’re secure, but because all ways to measure IT security come down to documentation, and, we certainly have that part covered. I guess that somewhere, shops that weren’t already trying to do their best to be as secure as possible with what resources they have, are going to do a GDPR risk analysis and go “hmmmm, maybe we should encrypt those data” or “hmmm, maybe we shouldn’t host our backup locally” or something along those lines. But at the end of the day, you’re still massively understaffed and on insane deadlines and working with tools that simply aren’t designed to be safe. I think the biggest issue is the illusion that all the documentation and focus will somehow make it safe eventually. It won’t. Not compared to not putting your powergrid on the internet. We had a big issue with our pools a few years back. For some reason, someone decides to put the pool controls on the internet, so that janitors didn’t have to go work some ledgers or whatever they did before. Of course it was horrible, because pool companies aren’t going to hire the experts or spend the time or money they need to make it as secure as it should be. But the biggest issue I have with it, is why it was done. You may think it was to save money, but the subscription to have the online pool controls were more expensive than having people just to check on them, and it’s not like an organisation with around 150 different buildings aren’t going to have janitors out there anyway. So there was simply no reason, and nobody really wanted the system, it just came with the pool. Then eventually one of them got hacked and the practice stopped, but do we really need to put these things online?