3 ms·

While I'm not sure exactly what to make of Chevron ruling, I have to say from Ops side, I would be happy to see decrease in the number of cybersecurity regulati

While I'm not sure exactly what to make of Chevron ruling, I have to say from Ops side, I would be happy to see decrease in the number of cybersecurity regulations/certifications. I think it's causing more harm than good. Why? Because InfoSec is spending more time on making check marks instead of actually improving our security posture. Also, almost every regulation allows business needs to override security by just writing up something. Last 3 companies I've been hacked despite being SOC2/ISO27000 certified because there was that out of date, internet facing system due to be replaced in 2020, we promise.

Buttons840 2y ago
Companies have some incentive to check the boxes, because they are often required to. Do companies have any incentive to improve their actual security posture? Has a company ever been harmed by having a poor security posture? I get your argument, there's some truth behind it. Being able to focus on actual security and less on security theater could be a good thing. But cynically, I think we're replacing a real incentive (security checkboxes), with non-incentives (actual security).
- alephnerd 2y ago
  I work in the industry and partially disagree with OP. There is credentialling BS but it's not regulators that push that. Regulators like the SEC instead require disclosure of breaches when they happen, and agencies like CISA have stepped in to remediate and fix deficient organizations after an attack (Hartsfield-Jackson Atlanta International Airport is a notable example) Now with Chevron removed, a breached entity could sue against mandated disclosure or government mandated remediation.
bithive123 2y ago
It's such a farce. You got a 70% on a multiple choice test and now you are "certified" in information security, nevermind that you don't know how to actually produce anything (neither a "dev" nor an "op"). But hey, the c-suite who hired you can only read pie charts and bar graphs, and is paid top dollar to make sure those boxes get checked, not to know how anything actually works. So you buy a bunch of automated scanning tools, pester the sysadmins to install multiple root-kits on all the servers, generate a bunch of PDF reports, and email them to those same sysadmins. You know, to help out the people who have been _achieving_ security (not just talking about it) for years. You rely on them to implement or document everything for you, but it never occurs that they could teach you a thing or two because they are not "certified". What they would consider their nuanced opinion tempered by years of experience comes across to you and your c-suite boss as complacent and change-resistant excuse-making.

Buttons840 2y ago

Companies have some incentive to check the boxes, because they are often required to. Do companies have any incentive to improve their actual security posture? Has a company ever been harmed by having a poor security posture? I get your argument, there's some truth behind it. Being able to focus on actual security and less on security theater could be a good thing. But cynically, I think we're replacing a real incentive (security checkboxes), with non-incentives (actual security).

alephnerd 2y ago
I work in the industry and partially disagree with OP. There is credentialling BS but it's not regulators that push that. Regulators like the SEC instead require disclosure of breaches when they happen, and agencies like CISA have stepped in to remediate and fix deficient organizations after an attack (Hartsfield-Jackson Atlanta International Airport is a notable example) Now with Chevron removed, a breached entity could sue against mandated disclosure or government mandated remediation.

bithive123 2y ago

It's such a farce. You got a 70% on a multiple choice test and now you are "certified" in information security, nevermind that you don't know how to actually produce anything (neither a "dev" nor an "op"). But hey, the c-suite who hired you can only read pie charts and bar graphs, and is paid top dollar to make sure those boxes get checked, not to know how anything actually works. So you buy a bunch of automated scanning tools, pester the sysadmins to install multiple root-kits on all the servers, generate a bunch of PDF reports, and email them to those same sysadmins. You know, to help out the people who have been _achieving_ security (not just talking about it) for years. You rely on them to implement or document everything for you, but it never occurs that they could teach you a thing or two because they are not "certified". What they would consider their nuanced opinion tempered by years of experience comes across to you and your c-suite boss as complacent and change-resistant excuse-making.