3 ms·
> And security work is rewarded even less While I do recognize that this is a pervasive problem, it seems counter-intuitive to me based on the tendency of the
by riknos314 2y ago
> And security work is rewarded even less
While I do recognize that this is a pervasive problem, it seems counter-intuitive to me based on the tendency of the human brain to be risk averse.
It raises an interesting question of "why doesn't the risk of security breaches trigger the emotions associated with risk in those making the decision of how much to invest in security?".
Downstream of that is likely "Can we communicate the security risk story in a way that more appropriately triggers the associated risk emotions?"
- giantg2 2y agoThe people making the decision don't have a direct negative impact. Someone's head might role, but that's usually far up the chain where the comp and connections are high enough to not care. The POs making the day to day decisions are under more pressure for new features than they are for security.
- SAI_Peregrinus 2y agoWhat is the consequence for security breaches? Usually some negative press everyone forgets in a week. Maybe a lost sale or two, but that's hard to measure. If you're exceedingly unlucky, an inconsequential fine. At worst paying for two years of credit monitoring for your users. What's the risk? The stock price will be back up by next week.
- amonon 2y agoeasier to consider people to tend towards conservative rather than risk averse. if we were truly risk averse, society would be very different.
- chii 2y agothe easy explanation is that the cost of a breach is externalized, so decision makers gain benefit from savings in not investing in security. Look at the crowdstrike failure as a recent example, but there's plenty more in the past.