On the one hand this is a great article with great research. On the other hand it shows extreme naïvety. As bad as this may seem, almost every company I have

On the one hand this is a great article with great research. On the other hand it shows extreme naïvety. As bad as this may seem, almost every company I have ever worked for - and I have worked for at least a dozen of the world's biggest most profitable companies - none of them care about security in practice. Publicly it's a different story, but back in the security department this happens: 1) security is always an afterthought on every project even if someone put it in the plan 2) the security department covers the entire organisation, that is: all processes, functions, applications, buildings, staff, hardware and software 3) the people that work in the security department cannot possibly have the kind of in-depth knowledge of every one of these and practically never have deep knowledge of any single one, to make the right decisions 4) the power of "No" is used in the place of finding out what is really needed from the real experts who don't work in security - ie they don't listen to anyone who doesn't work in their function The result is that most companies are vulnerable at almost every turn, but take the view that they only need to shut the barn door after the horse has bolted. And it makes perfect economic sense, as long as the horse has not bolted. If it has bolted then the decision makers go into damage limitation. That's how companies work so it does not surprise me at all that skilled knowledgeable people can expose these issues with ease. It's inevitable that what we saw at Sony will happen again and again. Perhaps this was the root cause of Blackberry's recent woes too. We may never know. Like he says... we live in interesting times.