3 ms·
> I have done what the law or insurance company wants to see and I have consultants as black sheep. You hit a great point. The law and insurance companies hav
by mfer 5y ago
> I have done what the law or insurance company wants to see and I have consultants as black sheep.
You hit a great point. The law and insurance companies have a major impact on what companies do.
If it's illegal (and they'll get caught) or the insurance companies say "do this to get insurance or if you don't do it the insurance doesn't cover you" people will make change.
That right there is a way to bring change.
Call your gov reps.
Let's get insurance companies to put security controls into coverage policies.
- markus_zhang 5y agoOne thing I'm a bit pessimistic is that insurance policies usually bring a lot of paper work and eventually it's just certificates over certificates. But again, maybe (a big maybe) this is still better than what things are going on right now. The best solution is for board members to have respect to their best techincal people and let them create processes best for individual companies. Sadly this is too personal and usually dies when a couple of people jump ship. Damn, management is so hard.
- bluGill 5y agoHopefully that make those certificates worthwhile someday. Right now they have earned a bad reputation, but with the right training behind it things could change.
- slx26 5y agoThe problem is always the same: to do things right, you need people who know what they are doing. Redundantly. Yet, most of us don't know what we are doing, so in practice we end up creating proxies for "the people who know what they are doing according to their certificates certify that I know what I'm doing". Because otherwise you wouldn't be accepted in a cool position, and we all want to be in a cool position. And that's how we end up with so much shit overflowing in the world, but people still pretend they have their own under control. Feeling greedy? Play pretend. A few hours later... Want to be accepted? Play pretend. A few hours later... Want to not be left out? Play pretend.
- bluGill 5y agoExcept that there are real attacks and the insurance companies affects will do postmortems to figure out why what they demanded didn't work. It will be a few rounds before they figure out how to train for this though. More than a few rounds because the bad guys are not stupid and thinking up new things that smart good people need to mitigate.