3 ms·
> By contrast, an attacker’s entire job is to attack the system. If cyber defence is a sideshow to the actual businesses objectives, then surely the same holds
by tsujamin 2y ago
> By contrast, an attacker’s entire job is to attack the system.
If cyber defence is a sideshow to the actual businesses objectives, then surely the same holds of cyber attack and whatever the actual criminal/strategic goal?
- tpmoney 2y agoNot at all. The attack is directly inline with the goal of getting to whatever is at the other end of the attack. By contrast, nothing about SSL certificates, forward secrecy, encryption at rest or authentication and access controls is inline with the goals of say Facebook to deliver as many cat pictures and political memes to you as possible, and as many eyeballs to advertisers as possible. Or put another way, in a world with 0 cyber security attackers, there would be no money or time spent on cyber security defense. But in a world with 0 cyber security defenders, there would still be people attacking resources and taking things the owners would rather they not have.
- makeitdouble 2y agoCyber attacks are in the same position as sales in most orgs: they can focus on getting other people's money and some failure rate is acceptable as they don't get paid much if they don't succeed. The org can invest as much as they bring in, they're a profit center, where defense is always a cost center that will be reduced to the minimum acceptable.