3 ms·

> But if it is security theater, how is that compliant with regulations? I think you are fundamentally misunderstanding what these regulations are. Regs get de

> But if it is security theater, how is that compliant with regulations? I think you are fundamentally misunderstanding what these regulations are. Regs get defined, then someone makes sure that the boxes are checked. They are not the same thing as (often being orthogonal to) having a strong security posture, that being far too dynamic and technical to encode in regulations. See https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html for discussion of SOC2, which should give you an idea of what we are talking about.

BrandoElFollito 4y ago
> that being far too dynamic and technical to encode in regulations First, that would require the regulating body to actually now what security is and how it works in the real world, in real companies. Then, it would require having an open mind regarding the risks and forget about 30 years of long gone history. If you look at ISO27002 (derived from the British BS-7799 30 years ago) you will note that it addresses very general ideas without a link to the reality of the field. If we had 5 rules that address real-world issues we would be light years ahead. Something like "a patch from teh vendor must be applied within 24 hours" (yes, one in a blue moon it will break things and slow down some fantasy "quarter end"), "MFA on all accounts used by humans" and 2-3 more like these. Just ask the people doing actual security 9-12 and then "compliance" 13-17, two totally disconnected activities.