3 ms·

It strikes me that companies need to look back at covid and consider the value IT provided to their business during that period, and the extent to which it has

by g_p 5y ago

It strikes me that companies need to look back at covid and consider the value IT provided to their business during that period, and the extent to which it has grown their business since the 90s. Then take that and allocate a reasonable chunk of that growth (say 15%) to ensuring that can continue, through ongoing investment in IT. Their alternative is to abandon the internet, go back to paper, and dump their IT costs (and boost to business). Unfortunately though, as long as there are bean counters trying to cut every outgoing and outsource every cost, and play accounting bingo to turn everything into monthly opex, it's unlikely to change. Most companies need skilled technical people because the sheer aggregation of risk in a few outsourced providers (see Kaseya recently) shows that they won't be top priority when something hits the fan. If they want to be top priority, they need the people on payroll and on site. Not everyone needs a group of rockstar 10x-types, but we do definitely need better fundamental IT knowledge and ability to solve problems. And business needs to make clear this is what's needed in terms of job adverts and compensation - supply tends to rapidly learn to deliver what's valued... If you can convince bean counters to pay anything for it, that is...

joe_the_user 5y ago
Companies for whom a data-loss will cause significant distress/damage to the public should be penalized for that loss, up and including jail time for their officers. Companies for whom data loss doesn't impact the public should be able to screw around however they want.
- lmm 5y ago
  The very nature of a limited-liability corporation encourages picking up nickels in front of a steamroller. Even holding the companies liable for the damages they do isn't enough, because they'll take risks that they can't ever repay (and jailing their officers might make us feel better but it can't un-steal your identity).
  - squiggleblaz 5y ago
    > they'll take risks that they can't ever repay (and jailing their officers might make us feel better but it can't un-steal your identity). I'm not sure exactly who the officers of a company are (genuinely) but if we're talking about the decision makers - the board and CEOs and whoever - not the employees, then most of them aren't going to take risks that make them genuinely likely to go to jail. Creating that genuine risk is probably the only way of manipulating their behavior, especially when they haven't got any real skin in the game (e.g. a CEO paid a few million and some irrelevant stock holdings in the company that make their net worth high, but which are safe to lose). The main issue is that such people are often well enough connected that they can spin a story that it's completely unreasonable to hold them responsible for their decisions. Personal responsibility is something for poor people. Someone will find a way to make the law that says legalese for "If personal data from a company is stolen because they chose to interpret the risks in way that unreasonably exaggerated the migitation costs and downplayed the restoration costs, or because they failed to consider the risks to the personal data they ought to have known they were collecting, then the CEO should go to prison for eight to eighteen months" mean "If the CEO personally steals personal data from a company and sells it to foreign agents, then they get twenty days in a luxury resort - but if they just use it to increase the cost of customers' insurance, then they get saddled with new high paying job, poor fellow".
    - g_p 5y ago
      I do wonder if the workplace safety/health and safety approach can be used here to good effect - even if your company's activities are nothing to do with safety, your workplace has to, by law, be safe, and company officers are responsible legally. The common message I hear about security is "it's not part of our core business". Safety was made (at least in some countries) to be part of your core business, as an unavoidable obligation. Nobody can use lack of information, capability, skill or awareness as a get-out for poor safety practices - you just have to do better. If we had the same with security, it might get the attentino of the board and its members.

by g_p 5y ago

joe_the_user 5y ago

Companies for whom a data-loss will cause significant distress/damage to the public should be penalized for that loss, up and including jail time for their officers. Companies for whom data loss doesn't impact the public should be able to screw around however they want.

lmm 5y ago
The very nature of a limited-liability corporation encourages picking up nickels in front of a steamroller. Even holding the companies liable for the damages they do isn't enough, because they'll take risks that they can't ever repay (and jailing their officers might make us feel better but it can't un-steal your identity).
- squiggleblaz 5y ago
  > they'll take risks that they can't ever repay (and jailing their officers might make us feel better but it can't un-steal your identity). I'm not sure exactly who the officers of a company are (genuinely) but if we're talking about the decision makers - the board and CEOs and whoever - not the employees, then most of them aren't going to take risks that make them genuinely likely to go to jail. Creating that genuine risk is probably the only way of manipulating their behavior, especially when they haven't got any real skin in the game (e.g. a CEO paid a few million and some irrelevant stock holdings in the company that make their net worth high, but which are safe to lose). The main issue is that such people are often well enough connected that they can spin a story that it's completely unreasonable to hold them responsible for their decisions. Personal responsibility is something for poor people. Someone will find a way to make the law that says legalese for "If personal data from a company is stolen because they chose to interpret the risks in way that unreasonably exaggerated the migitation costs and downplayed the restoration costs, or because they failed to consider the risks to the personal data they ought to have known they were collecting, then the CEO should go to prison for eight to eighteen months" mean "If the CEO personally steals personal data from a company and sells it to foreign agents, then they get twenty days in a luxury resort - but if they just use it to increase the cost of customers' insurance, then they get saddled with new high paying job, poor fellow".
  - g_p 5y ago
    I do wonder if the workplace safety/health and safety approach can be used here to good effect - even if your company's activities are nothing to do with safety, your workplace has to, by law, be safe, and company officers are responsible legally. The common message I hear about security is "it's not part of our core business". Safety was made (at least in some countries) to be part of your core business, as an unavoidable obligation. Nobody can use lack of information, capability, skill or awareness as a get-out for poor safety practices - you just have to do better. If we had the same with security, it might get the attentino of the board and its members.