3 ms·
> "Shove Stupid Shit Someplace Secret" This sums up the broad concept of Compliance and security in general. The people who pretend to care about compliance (i
by pphysch 2y ago
> "Shove Stupid Shit Someplace Secret"
This sums up the broad concept of Compliance and security in general. The people who pretend to care about compliance (i.e. management) don't have the technical know-how to grok the implementations by those who pretend to implement said compliant systems. There isn't remotely enough QA/red-teaming (expensive to do in a bias-free manner), most of the time all you need to do is scribble in the box and everyone is going to squint and pretend it's checked.
- jimbokun 2y agoI work on software for the healthcare industry, and recently found out about PHI (private health information) insurance. Basically they pay out if you suffer a breach, The part I found interesting is that the premiums vary based on their assessment of your practices. This strongly aligns their incentives with actual best practices when evaluating your systems, as they are on the hook financially for any breach.