3 ms·

I wonder about the trust aspect of CISAs vulnerability scanning offers towards businesses. Do business owners jump at the opportunity to take advantage of this?

I wonder about the trust aspect of CISAs vulnerability scanning offers towards businesses. Do business owners jump at the opportunity to take advantage of this? I don’t see it. It’d be beneficial but I wonder if the general sentiment would caution against a federal agency sniffing out vulnerabilities.

lbriner 5y ago
The government could scan your stuff anyway so not registering doesn't stop them doing anything nefarious. The better question is, is the security you already do yourself good enough that you don't want or need CISA to do it? If not then it is better than doing nothing.
ldoughty 5y ago
The moment I saw that I sent an email to register. I work at a small government agency (closer to a small business) with 20 FTE... Only 2 if which have the skill set and "wear a hat" that could cover vulnerability scanning or such security. While they are good at responding to incidents that make the news and patching immediately... they do not actively spend time scanning / looking for issues that do not trip alarms.
MrWiffles 5y ago
It depends on your situation of course. Since may be interested purely from a liability avoidance/shield perspective. Just to check the box, essentially. Since we’ve seen how much the suits truly care about security of user start data practically every week or month for over a decade now. Another day, another major corporate data breach. They don’t suffer any consequences for failure beyond the occasional slap on the wrist for PR purposes, yet real people have their entire lives destroyed because of this crap every day. Families without a place to live, children without food to eat. But hey, $BIGCORP can say they checked the box! Doesn’t matter what happens now, they’re in compliance! User data? Why waste more money on securing that, we’re just going to pimp them all out anyway! But hey, we checked the box! (Obvious sarcasm is obvious.)
deleted 5y ago
[deleted]

lbriner 5y ago

The government could scan your stuff anyway so not registering doesn't stop them doing anything nefarious. The better question is, is the security you already do yourself good enough that you don't want or need CISA to do it? If not then it is better than doing nothing.

ldoughty 5y ago

The moment I saw that I sent an email to register. I work at a small government agency (closer to a small business) with 20 FTE... Only 2 if which have the skill set and "wear a hat" that could cover vulnerability scanning or such security. While they are good at responding to incidents that make the news and patching immediately... they do not actively spend time scanning / looking for issues that do not trip alarms.

MrWiffles 5y ago

It depends on your situation of course. Since may be interested purely from a liability avoidance/shield perspective. Just to check the box, essentially. Since we’ve seen how much the suits truly care about security of user start data practically every week or month for over a decade now. Another day, another major corporate data breach. They don’t suffer any consequences for failure beyond the occasional slap on the wrist for PR purposes, yet real people have their entire lives destroyed because of this crap every day. Families without a place to live, children without food to eat. But hey, $BIGCORP can say they checked the box! Doesn’t matter what happens now, they’re in compliance! User data? Why waste more money on securing that, we’re just going to pimp them all out anyway! But hey, we checked the box! (Obvious sarcasm is obvious.)

deleted 5y ago

[deleted]