3 ms·

You know, I've worked in IT long enough -- 25 years now! -- to watch the rise of "the cybersecurity professional", and their place as a rubber-stamp of acceptab

You know, I've worked in IT long enough -- 25 years now! -- to watch the rise of "the cybersecurity professional", and their place as a rubber-stamp of acceptability in the food chain of business IT. I'm sorry if you find this comment to be incendiary, and an attack against you in particular. It most certainly is not. I do understand that there's a wide chasm between the state of the industry and the intentions of individual people. If it's any consolation, I've found that my own work is mostly a kind of rubber stamp too, and lately I've begun to question the entire endeavor. What are we actually working to do anymore? Beats me, really. But, I do find some irony in a statement like "it is critical, it will be applied immediately, breaking systems and important presentations of the C-whatever. If the business has something against me then feel free to escalate to my management" when the title of the article we're talking about is Report: 95% of employees say IT issues decrease workplace productivity and morale. If you don't see the connection between "I don't care how this affects you" and "IT causes low productivity and morale", well then I guess all I can do is laugh, and be glad I've left IT desk work for data center technician work.

BrandoElFollito 4y ago
I am in the same boat, about 30 years of IT and moved to information security 15 years ago because it was a very interesting challenge. I understand your rubber-stamp thing (I see it a lot with "audits") but I refuse to be one. This is a lot of friction but ultimately I got the trust of the company (a very big company). One of the things I changed about 6 or 8 years ago was the patching process. Patching was done during maintenance windows and froze during quarter ends and similar. OTOH a wormable vulnerability, a ero day or similar will not wait - so I requested a decision of the owners of the data: either availability or security. They asked me all kind of questions such as "what is the probability" to what I answered that I have no idea. But if the recommendation of the vendor is to patch NOW then utr is also mine. And our systems are always patched, and I sleep better, they sleep better, everyone sleeps better. If you work in IT you know what this is either the useless dept that puts barriers, or the saviour when there is trouble. Nobody from these 95% realize that there may be reasons for the restrictions, even if at home they do not need a password or backup or patch or something. It would be much easier to work in some "added values" departments such as marketing and not in the water^H^H^H^H^H IT one.But I love my work.

BrandoElFollito 4y ago

I am in the same boat, about 30 years of IT and moved to information security 15 years ago because it was a very interesting challenge. I understand your rubber-stamp thing (I see it a lot with "audits") but I refuse to be one. This is a lot of friction but ultimately I got the trust of the company (a very big company). One of the things I changed about 6 or 8 years ago was the patching process. Patching was done during maintenance windows and froze during quarter ends and similar. OTOH a wormable vulnerability, a ero day or similar will not wait - so I requested a decision of the owners of the data: either availability or security. They asked me all kind of questions such as "what is the probability" to what I answered that I have no idea. But if the recommendation of the vendor is to patch NOW then utr is also mine. And our systems are always patched, and I sleep better, they sleep better, everyone sleeps better. If you work in IT you know what this is either the useless dept that puts barriers, or the saviour when there is trouble. Nobody from these 95% realize that there may be reasons for the restrictions, even if at home they do not need a password or backup or patch or something. It would be much easier to work in some "added values" departments such as marketing and not in the water^H^H^H^H^H IT one.But I love my work.