I was the CISO at a healthcare company for several years and still work in security engineering. "There is nothing more important than securing our systems" sou

I was the CISO at a healthcare company for several years and still work in security engineering. "There is nothing more important than securing our systems" sounds good but falls over when you look closely. Of course you should design and implement secure systems. You owe that to your customers. Still, that's meaningless until you decide what "secure" means. How valuable is your data to your customers and to potential attackers? Who's likely to target you? What level of risk are you willing to accept? And make no mistake: you do accept a certain level of risk. If your systems are valuable enough, you're going to get the attention of enemy nations who will attack you. How much are you willing to invest to protect against North Korea or Russia? Short of financing a formal proof of every bit of software you run on, from web frontend down to microcode, you're trusting that someone else did their job correctly. And will you run that unprecedentedly secure code on a server farm inside Fort Knox? Job one in security is deciding how much you need to invest to reach the level of security you need to achieve. If you're storing healthcare data, that's going to be a whole lot of time and money, and even then good luck if a malicious nation wants in. If you're storing grocery store shopping lists for a thousand people, and you're investing $10,000,000 to secure it, please call me because I want in on that action. Looks like Stedi's in a field where security matters an awful lot and it's great to hear that they take it seriously. However, I'd love to hear what that actually means in practice.