3 ms·

Interestingly, very often security is also not the real goal of entities that are supposedly in charge of security, whether specialized security vendors or in h

by tgma 2y ago

Interestingly, very often security is also not the real goal of entities that are supposedly in charge of security, whether specialized security vendors or in house security teams; compliance and cover-your-ass is. I have seen more than once that the CYA security theater in fact directly causes security problems. Quite often, the rare secure systems are built by great product teams who understand and are passionate about user data and security of the product themselves and architect the system accordingly.

deleted 2y ago
[deleted]
ang_cire 2y ago
To be frank, if I could choose which of those to achieve, and it would be perfectly achieved, I'd choose actual security, but the reality is that it's impossible to actually meet most SLAs. I have met exactly 0 infosec folks who can honestly claim their company meets patching SLAs, much less vuln SLAs in general. And as the saying goes, if one employee is failing, that's a personnel issue. If many employees are failing, that's a management issue. The entities in charge of security are always the boardroom Executives of the company, ultimately, because they set the strategic priorities and silo budgets. And their main goal is never actually security.
BrandoElFollito 2y ago
Working in cybersecurity in an average large company is usually miserable when you want to do it right. You are trapped between business metrics, laziness, and lack of interest in modern technologies. On the one hand, you have businesses that claim that they will lose millions in revenues if their shitty site/service is down. Then you have users that do not give a crap about security: they have goals and security s not one of them. Finally, you have IT where there you either have under-the-radar operations for people interested in something, or an average to low understanding of technology. And there you are: you are "responsible" for making sure that the company is secure (per its ads) but cannot hurt the business. If there is an incident it is your fault anyway. It s not a surprise that burnout in cybersecurity is high. Or that security experts' goal is to have all the chekmarks no matter the reality (the ass covered approach). Or you have the rare CISO who will be pissed off by such things and will force their way to bring in real security (which is not rocket science: patch, configure correctly, use MFA and occasionally think before you do something). Some fail and leave, some become the enterprise assholes you do not want to deal with and, alllll right, you implement what they want because they piss you off. The unsung hero.
- tiltowait 2y ago
  I work in security, and we just got the kind of CISO you mentioned. It’s glorious. People listen to me now.
  - BrandoElFollito 2y ago
    I work in security as well and hope to be that CISO for my team :) It's kinda sad that one needs to become that annoying rock you cannot just push away to put in place sensible security measures that profit everyone. It does not help at all that there is so many, so fucking much shitty security requirements|standards|under-the-shower-visons arend and this security theater makes us lose credibility. As an example, it had been, what, 10 years that I have been fighting with external auditors regarding password complexity. I was pushing what is now the NIST standard and every year I was confronted with the checkmark "small, caps, digits, special characters (but not <>') changed every 30 days" and was just saying that I would not sign off because we have something that simply makes sense. As in common sense, backed with 4th grade maths.

by tgma 2y ago

deleted 2y ago

[deleted]

ang_cire 2y ago

To be frank, if I could choose which of those to achieve, and it would be perfectly achieved, I'd choose actual security, but the reality is that it's impossible to actually meet most SLAs. I have met exactly 0 infosec folks who can honestly claim their company meets patching SLAs, much less vuln SLAs in general. And as the saying goes, if one employee is failing, that's a personnel issue. If many employees are failing, that's a management issue. The entities in charge of security are always the boardroom Executives of the company, ultimately, because they set the strategic priorities and silo budgets. And their main goal is never actually security.

BrandoElFollito 2y ago

Working in cybersecurity in an average large company is usually miserable when you want to do it right. You are trapped between business metrics, laziness, and lack of interest in modern technologies. On the one hand, you have businesses that claim that they will lose millions in revenues if their shitty site/service is down. Then you have users that do not give a crap about security: they have goals and security s not one of them. Finally, you have IT where there you either have under-the-radar operations for people interested in something, or an average to low understanding of technology. And there you are: you are "responsible" for making sure that the company is secure (per its ads) but cannot hurt the business. If there is an incident it is your fault anyway. It s not a surprise that burnout in cybersecurity is high. Or that security experts' goal is to have all the chekmarks no matter the reality (the ass covered approach). Or you have the rare CISO who will be pissed off by such things and will force their way to bring in real security (which is not rocket science: patch, configure correctly, use MFA and occasionally think before you do something). Some fail and leave, some become the enterprise assholes you do not want to deal with and, alllll right, you implement what they want because they piss you off. The unsung hero.

tiltowait 2y ago
I work in security, and we just got the kind of CISO you mentioned. It’s glorious. People listen to me now.
- BrandoElFollito 2y ago
  I work in security as well and hope to be that CISO for my team :) It's kinda sad that one needs to become that annoying rock you cannot just push away to put in place sensible security measures that profit everyone. It does not help at all that there is so many, so fucking much shitty security requirements|standards|under-the-shower-visons arend and this security theater makes us lose credibility. As an example, it had been, what, 10 years that I have been fighting with external auditors regarding password complexity. I was pushing what is now the NIST standard and every year I was confronted with the checkmark "small, caps, digits, special characters (but not <>') changed every 30 days" and was just saying that I would not sign off because we have something that simply makes sense. As in common sense, backed with 4th grade maths.