Who defines "best security practices"? Agreed. In my company, "best practices" means "what I want," "what I'm used to," "what the sales guy is selling", or "w

Who defines "best security practices"? Agreed. In my company, "best practices" means "what I want," "what I'm used to," "what the sales guy is selling", or "what my boss wants." There is no such thing as "best practices," and certainly no "best security practices." Such a thing would have to be developed, perhaps by NIST. And even then, it would only exist as a baseline so that middle managers could mark a checkbox off on a list. The only solution I can think of is to make companies financially liable in a way that actually hurts them. One of the reasons that healthcare companies run around in a HIPAA hysteria is that HIPAA violations can actually cause them great financial harm. The same cannot be said for mot of the tech industry.