5 ms·

Many times. Before the first high profile hacks (that I remember) in 2011, Sony's CTO made a career of giving high profile talks about, essentially, reducing yo

Many times. Before the first high profile hacks (that I remember) in 2011, Sony's CTO made a career of giving high profile talks about, essentially, reducing your IT budget by not doing security. Don't do pentests, don't do audits - they only uncover issues for your teams to fix! Certifications are an industry that sells you problems, he said. Ignore and skimp on the whole thing. IIRC there was even a great talk about how to ignore your engineers when they say something is urgent. He didn't get fired after the first round of hacks, and he wasn't fired after the 2014 round either. I wonder where he is now?

jonny_eh 3y ago
Can you, uh, provide evidence and a name? That's some inflammatory stuff there!
- johnnyworker 3y ago
  I'd love to see those talks too, because stuff like this needs to be preserved. Not to shame individuals but for the history of comedy in general.
- ohthehugemanate 3y ago
  Not so inflammatory at the time. Those were wild days. Someone else posted his CIO article about "just enough compliance", but IIRC there were talk summaries and interviews around, too. And for the comedy factor: those hacks were dictionary password attacks against leaked usernames, and a plain text file left laying on an open network share with key credentials. Not exactly oceans' eleven.
tpmx 3y ago
See also: "Your Guide To Good-Enough Compliance" (2007) https://www.cio.com/article/272225/risk-management-your-guide-to-good-enough-compliance.html https://www.cio.com/article/272225/risk-management-your-guid... Noncompliance is a fact of life as the list of security and privacy regulations grows. The key is knowing how to comply just enough so that you don't waste your time or bankrupt your company.
- mavhc 3y ago
  Sony are still in business
- gmerc 3y ago
  Hence privacy fines became the way Europe now extracts its fair taxes from Big Tech
rekoil 3y ago
They were not entirely wrong about the certifications to be honest, there are a lot of useless certifications. In general they were very wrong though.
ptx 3y ago
The person this seems to be referring to, according to info in the article posted in a sibling comment and a Time article [0] about the 2014 hack, is Jason Spaltro, executive director of information security. An interesting piece of info in the Time article is that Sony only had 3 people working on infosec, excluding managers. [0] https://time.com/3620288/sony-hack-unprepared/ https://time.com/3620288/sony-hack-unprepared/

jonny_eh 3y ago

Can you, uh, provide evidence and a name? That's some inflammatory stuff there!

johnnyworker 3y ago
I'd love to see those talks too, because stuff like this needs to be preserved. Not to shame individuals but for the history of comedy in general.
ohthehugemanate 3y ago
Not so inflammatory at the time. Those were wild days. Someone else posted his CIO article about "just enough compliance", but IIRC there were talk summaries and interviews around, too. And for the comedy factor: those hacks were dictionary password attacks against leaked usernames, and a plain text file left laying on an open network share with key credentials. Not exactly oceans' eleven.

tpmx 3y ago

See also: "Your Guide To Good-Enough Compliance" (2007) https://www.cio.com/article/272225/risk-management-your-guide-to-good-enough-compliance.html https://www.cio.com/article/272225/risk-management-your-guid... Noncompliance is a fact of life as the list of security and privacy regulations grows. The key is knowing how to comply just enough so that you don't waste your time or bankrupt your company.

mavhc 3y ago
Sony are still in business
gmerc 3y ago
Hence privacy fines became the way Europe now extracts its fair taxes from Big Tech

rekoil 3y ago

They were not entirely wrong about the certifications to be honest, there are a lot of useless certifications. In general they were very wrong though.

ptx 3y ago

The person this seems to be referring to, according to info in the article posted in a sibling comment and a Time article [0] about the 2014 hack, is Jason Spaltro, executive director of information security. An interesting piece of info in the Time article is that Sony only had 3 people working on infosec, excluding managers. [0] https://time.com/3620288/sony-hack-unprepared/ https://time.com/3620288/sony-hack-unprepared/