3 ms·

I agree in a theoretical way. But in the real world corporations don't have skilled infosec/cyber people and they wouldn't even know how to find them [1]. So th

by alecco 1y ago

I agree in a theoretical way. But in the real world corporations don't have skilled infosec/cyber people and they wouldn't even know how to find them [1]. So they end up with incompetent departments imposing ridiculous limitations for theater. And these worsen end user aversion to security. Younger generations care less and less about security and privacy. And the growing corporate disdain of employees (in particular to the ones who sacrificed to the company) make employees care even less. There were recent cases of employees selling corporate secrets for peanuts. And many gangs just reach out to employees being laid off to gain access. I know from second-hand this was the way it happened in one of the biggest ransomware scandals a couple of years ago. I really don't know how to fix this situation. In fact, it seems to be deteriorating very fast. [1] https://en.wikipedia.org/wiki/The_Market_for_Lemons#Conditions_for_a_lemon_market https://en.wikipedia.org/wiki/The_Market_for_Lemons#Conditio...

kube-system 1y ago
Training can help to reduce failures, but it can never prevent failures, because even at the minimum, human err at scale is guaranteed. If a monkey randomly types on a typewriter for an infinite amount of time, it will eventually produce any given text, including ̶t̶h̶e̶ ̶c̶o̶m̶p̶l̶e̶t̶e̶ ̶w̶o̶r̶k̶s̶ ̶o̶f̶ ̶S̶h̶a̶k̶e̶s̶p̶e̶a̶r̶e̶.̶ opening a ransomware attachment
- GTP 1y ago
  > Training can help to reduce failures, but it can never prevent failures, because even at the minimum, human err at scale is guaranteed Sure,and indeed the goal is to have better security, not prefect security. If you look for the perfect solution, you will never find it.
Bender 1y ago
But in the real world corporations don't have skilled infosec/cyber people and they wouldn't even know how to find them That was not my experience at the last employer. We had some incredibly talented security architects, engineers and developers. The issue we ran into was that some of the early hires were a bit over-zealous and created a layer of fear in management that the security teams would induce too much friction, some that was indeed needed. The result was the head of software development put a development manager in charge of the entire security org. Their standing order was to never say "no" and never get in the way. It's still a more secure company than most but it's a constant battle with management and leads to burnout and that is one of the many reasons myself and many others retired early. Most other reasons for me were unrelated to the company.

by alecco 1y ago

kube-system 1y ago

Training can help to reduce failures, but it can never prevent failures, because even at the minimum, human err at scale is guaranteed. If a monkey randomly types on a typewriter for an infinite amount of time, it will eventually produce any given text, including ̶t̶h̶e̶ ̶c̶o̶m̶p̶l̶e̶t̶e̶ ̶w̶o̶r̶k̶s̶ ̶o̶f̶ ̶S̶h̶a̶k̶e̶s̶p̶e̶a̶r̶e̶.̶ opening a ransomware attachment

GTP 1y ago
> Training can help to reduce failures, but it can never prevent failures, because even at the minimum, human err at scale is guaranteed Sure,and indeed the goal is to have better security, not prefect security. If you look for the perfect solution, you will never find it.

Bender 1y ago

But in the real world corporations don't have skilled infosec/cyber people and they wouldn't even know how to find them That was not my experience at the last employer. We had some incredibly talented security architects, engineers and developers. The issue we ran into was that some of the early hires were a bit over-zealous and created a layer of fear in management that the security teams would induce too much friction, some that was indeed needed. The result was the head of software development put a development manager in charge of the entire security org. Their standing order was to never say "no" and never get in the way. It's still a more secure company than most but it's a constant battle with management and leads to burnout and that is one of the many reasons myself and many others retired early. Most other reasons for me were unrelated to the company.