3 ms·
My experience is companies treating security as if it were a competition where having more "security points" than the hacker means you can't be hacked. Which le
by blowski 5y ago
My experience is companies treating security as if it were a competition where having more "security points" than the hacker means you can't be hacked. Which leads to bizarrely wrong trade-offs like "we don't need passwords on the prod database because it's only accessible through the private network". Even worse is "we're on AWS so we have Amazon-level security".
- TriNetra 5y agoThat's actually anti-ZT practice, which clearly requires that you put maximum security controls you can to protect every resource. especially do not assume trust based on network location/perimeter, is very first tenet. But yeah, security in many orgs (regardless of the size), is another item to be ticked, and thus a false sense of security prevails until an incident happens. Eventually, only such orgs will survive and thrive which will be able to defend their resources, in the increasingly hostile online environment with state-backed attackers. Whether this defense comes from individual organizations or their state, or a combination of both, that's something to be seen in the next 5 to 10 years.