2 ms·
I don't find it remotely hard to believe that the skills needed to be a 'hacker' and the skills needed to run a security organization for a billion-dollar healt
by pc86 5y ago
I don't find it remotely hard to believe that the skills needed to be a 'hacker' and the skills needed to run a security organization for a billion-dollar healthcare organization have zero overlap. You don't want a CISO or VP of CS to be playing around in VMware. That's got nothing to do with their job.
- rasz 5y agoI attended CISO course run by Uni of Washington https://www.washington.edu/research/research-centers/center-for-information-assurance-and-cybersecurity-ciac/ https://www.washington.edu/research/research-centers/center-... It was total garbage by clueless paper pushers. Main focus was on securing business agreements delegating responsibility, aka deflecting the blame. There was zero time spend on actually securing anything, it was all theatre or/and way of funneling funds to select companies from private sector (like Kronos).
- seventhtiger 5y agoI wouldn't say it's the main focus, but this is an extremely valuable risk treatment. I would say it's underrated. Too many orgs go into do or die mode and try to do everything and do it poorly. Accepting risk is a liability no person in authority ever wants to sign, even if it's accepting the risk of an earth destroying comet. They will ask you to do what you can instead, when you don't have enough resources to even begin implementing the needed controls. Often in info sec governance literally the only way for us to get leadership to accept a realistic scope is to do as much risk transference as possible.