3 ms·

if you limit your shopping to companies that can respond timely to security incidents, you won't shop at all.

• freehunter 12y ago
  Even in the wake of Target, security at many companies is still compliance-driven and consists solely of running through a checklist to ensure you will pass an audit. There's no budget or appetite for actually securing a company's IT assets. The worst I've heard is "that would require a major shift in company culture, and we won't get buy-in". And they get hacked, the CEO loses his head, the next guy steps in, and... still nothing changes. And the security team will never be able to get a job at any other company because people blame them for everything that happened. But flip that to the startup side, and I've heard a lot of "we're a lean startup" or "security is everyone's job" so you never find a security engineer at a company with 20 employees, 19 of which are SEO and social marketing. The state of security in general is just so massively disappointing.