4 ms·
Security is of adversarial nature. Us vs them. But the reason I find your comment interesting is that it turns that towards the inside. Trivially the ones to
by dgb23 3y ago
Security is of adversarial nature. Us vs them.
But the reason I find your comment interesting is that it turns that towards the inside.
Trivially the ones to blame are the attackers. But the responsibility for protecting against them is treated like a hot potato. It seems to be more important to say “It’s not our fault” than to prevent attacks.
Why is that?
I think a big reason is the interface of the technical side. People want to hear that it’s safe, but engineers can only really say “It’s safe against these particular things.” But it’s uncomfortable to hear that.
- afiori 3y agoIf the approach to a accident/catastrophe/breach is to find guilt and assign blame then there are strong and clear incentives to avoid blame. In a lot of contexts this cannot be significantly changed by company culture as many legal systems adopt this approach. The oft mentioned other approach is to assume that human and operational error cannot be eliminated[0] and design systems to withstands many compounding mistakes. Afaik we do this only in aviation and infrastructure [0] these two approaches are similar and live on a continuum between "we punished the guilty party, the problem is no more" and "let's make sure that this not any similar problem never happens again". Both extremes are often wrong, but in many cases it is a good idea to move towards the latter.