3 ms·
Why would you or anyone in your American company care about complying with Tajikistan law?
by inigyou 3mo ago
Why would you or anyone in your American company care about complying with Tajikistan law?
- ofjcihen 3mo agoLess about that. More about “not accidentally funding terrorism” (or, more realistically, not giving money to sanctioned countries which can have significant consequences).
- michaelt 3mo agoCISO: "We're going to invite random strangers from all around the globe to hack us, and pay them for their findings" CEO: "I'm not sure I like the idea of us inviting people to hack us - or paying a 'bounty' to hackers holding a knife to our throat. Will they at least agree to a binding NDA and terms of engagement, in advance?" CISO: "No, they won't." CEO: "Well, at least if the hackers are in poor countries, a $500 payout for a critical bug will be plenty, right?" CISO: "No, critical issues will be 10-100x that" CEO: "Well will the average quality of these reports better than those we get from our hired pentesters?" CISO: "On average these will be the lowest quality reports you've ever seen. But 0.1% might be gold. Oh, and I need to hire 3 more guys to sift through these terrible reports. Also our sifters might miss the gold." CEO: "Oh. Well at least we won't be breaking the law though, right?" CISO: "Uh, about that..."