4 ms·
In my experience, many corporate infosec guys are basically just beancounters without a deeper understanding of information security.
by steve1977 3y ago
In my experience, many corporate infosec guys are basically just beancounters without a deeper understanding of information security.
- jeremyjh 3y agoYes, unfortunately any kind of staff position that does not deliver product attracts these types who just want to hide and never be accountable for delivering value to the business. I'm not saying the positions aren't needed or valuable, but just that it is appealing to the wrong kind of people.
- jollyllama 3y agoAnd unfortunately, their value is often directly proportional to the amount of workload they add to the productive segments. People wonder why security teams are the first to be cut during hard times, but this is basically why. That said, I can see both sides of it, security is obviously of great importance. But there just has to be a better way, perhaps some categorization of threat models cross referenced against the CVEs/etc.
- steve1977 3y ago> security is obviously of great importance. It is. But the thing is, those corporate infosec folks I'm talking don't actually improve security. It's the same as with many audits.
- Nullabillity 3y agoShoving out endless amounts of broken trash has negative value to society, even if it makes the company money hand over fist.
- patrakov 3y agoI have personally rejected a candidate that claims to know professional security tools but maintains that it is not his job to filter out false positives ("because they don't exist") before presenting the results to the developer team. The same candidate would also say "you need a firewall" but would not be able, in an interview setting, to explain how to protect the database server using a firewall - i.e., what exactly to allow.