5 ms·

One could hope but I doubt it. CFO's gonna CFO and it's "cheaper" to outsource IT. I had one of these vendors really pushing me to "take a call" or "let them sh

One could hope but I doubt it. CFO's gonna CFO and it's "cheaper" to outsource IT. I had one of these vendors really pushing me to "take a call" or "let them show me how they could cut costs". It was ALL about the costs. And I eventually called the CEO and said we would consider it if the company would take out a $100M bond that we could call on to repair any damage that occurred as a result of their managing our IT systems. He thought that was ridiculous of course and thought poorly of me. Since that time at least two of his customers have been the victims of breaches that IT either directly facilitated or indirectly made possible by providing additional attack surface that was required for their business to work. But not every person who has executive oversight of operations thinks like I do, and all of them are represented in the company's finances as a 'cost center' that is second only to Payroll in terms of how juicy a 'cost reduction' target it presents. So when the going gets tough, the company cuts back its IT budget.

ipdd 5y ago
The CEO and CFO are right because this notion of reducing "attack surface" is not static. It changes from day to day and no technologist can guarantee what changes they add today makes any difference tomorrow. The promise is False. Therefore the principle of least action is justified.
- kaba0 5y ago
  “I will gotta leave open the windows and the door, and won’t even finish building the gates because I’m planning on extending the building and I will have to tore down a part either way”
jart 5y ago
I keep reading over and over again indignant comments about "cost centers" on Hacker News and I think it's not a good term to use because I looked up the definitions and the only logical consensus I could find is that everything which isn't shareholder profit is a cost center. It's just rhetoric.
- sgt101 5y ago
  I don't think it is - I think it's cultural and organisational. The CFO and Finance in general see businesses as capital flows, they don't see value being added - just opportunities for leverage and cash management. The description of a cost center is a labelling denoting a target for removal and reduction - the destruction of value that occurs (typically 12 -24 months after the exercise) is seen as disconnected and irrelevant.
  - jart 5y ago
    Eye of the beholder topics don't generalize. If your CFO and Finance team is doing things like laying off all the information security people since they thought Axa would pay the ransom gangs, then state the name of the company. Otherwise it's just venting handwavy frustration about people whose job requires taking risk mitigation seriously.
    - sgt101 5y ago
      I'm not going to name companies as I don't fancy the blowback, but the fact is that CFO's aren't doing risk minimisation, they're doing bonus optimization. There is a common misconception that CFO's fiduciary duty to their shareholders determines that they should protect the long term stability of the company, but now most shareholders are in the company for 6mths tops. The duration of a CFO's fiduciary duty is arguably about 6mths out. The devastation of large companies in the economies of the west since 1980 is a testament to this.
  - srtjstjsj 5y ago
    But everything is a cost center , even product development and sales. A salesperson is a cost center except for the singular moments when they sign a deal.
    - syshum 5y ago
      It comes down to the balance Fake Numbers: sales "generates" 100,000,000 in revenue and "costs" 1,000,000 however IT "generates" 0 in revenue and "costs" 2,000,000 So to an bean counter, clearly the "investment" in sales is better because they make money for the company, where IT just costs money... Thus IT is often treated like a utility service, say something like custodial services, where they want to find the cheapest way to keep the bathrooms not disgusting... not clean mind you, just not disgusting

ipdd 5y ago

The CEO and CFO are right because this notion of reducing "attack surface" is not static. It changes from day to day and no technologist can guarantee what changes they add today makes any difference tomorrow. The promise is False. Therefore the principle of least action is justified.

kaba0 5y ago
“I will gotta leave open the windows and the door, and won’t even finish building the gates because I’m planning on extending the building and I will have to tore down a part either way”

jart 5y ago

I keep reading over and over again indignant comments about "cost centers" on Hacker News and I think it's not a good term to use because I looked up the definitions and the only logical consensus I could find is that everything which isn't shareholder profit is a cost center. It's just rhetoric.

sgt101 5y ago
I don't think it is - I think it's cultural and organisational. The CFO and Finance in general see businesses as capital flows, they don't see value being added - just opportunities for leverage and cash management. The description of a cost center is a labelling denoting a target for removal and reduction - the destruction of value that occurs (typically 12 -24 months after the exercise) is seen as disconnected and irrelevant.
- jart 5y ago
  Eye of the beholder topics don't generalize. If your CFO and Finance team is doing things like laying off all the information security people since they thought Axa would pay the ransom gangs, then state the name of the company. Otherwise it's just venting handwavy frustration about people whose job requires taking risk mitigation seriously.
  - sgt101 5y ago
    I'm not going to name companies as I don't fancy the blowback, but the fact is that CFO's aren't doing risk minimisation, they're doing bonus optimization. There is a common misconception that CFO's fiduciary duty to their shareholders determines that they should protect the long term stability of the company, but now most shareholders are in the company for 6mths tops. The duration of a CFO's fiduciary duty is arguably about 6mths out. The devastation of large companies in the economies of the west since 1980 is a testament to this.
- srtjstjsj 5y ago
  But everything is a cost center , even product development and sales. A salesperson is a cost center except for the singular moments when they sign a deal.
  - syshum 5y ago
    It comes down to the balance Fake Numbers: sales "generates" 100,000,000 in revenue and "costs" 1,000,000 however IT "generates" 0 in revenue and "costs" 2,000,000 So to an bean counter, clearly the "investment" in sales is better because they make money for the company, where IT just costs money... Thus IT is often treated like a utility service, say something like custodial services, where they want to find the cheapest way to keep the bathrooms not disgusting... not clean mind you, just not disgusting