After having finished my master's degree I realized something important that must be understood about corporate security. Corporate/Enterprise security has not

After having finished my master's degree I realized something important that must be understood about corporate security. Corporate/Enterprise security has nothing to do with securing things it has to do with offloading risk and liability. It isn't about making things secure it's about making sure you don't get blamed when things do happen. Because when security things do happen it's the customers who take the shafting not the organization itself, who cares if you get slapped with a fine or lawsuit it doesn't have much to do with the stock price and is likely going to be less expensive then actually implementing real security controls. This also explains why there are so many people selling security "solutions" out there, because the C suite doesn't really care about security, in fact they may not even want it, after all with real security comes real monitoring and logging and non-repudiation which can get important people in trouble if it's found out, they want to check the box that says the paid for super secure stuff and now if it doesn't work they just turn around and blame the vendor and bicker with them. All this happening while their customers identities are being stolen and their data sold. Remember CSO stands for Chief Sacrificial Officer. Ultimately if we really want to be secure we must realize that at the end of the day security isn't some glamorous special super world of spies and hackers. Security is 90% just a QA problem, once security gets reframed as a quality problem it allows to start addressing it like the problem it is and not the security theater that is constantly going on.