5 ms·

Fun hack, but - yet another stupid large bank/corporation, probably underpaying their devs and not reviewing code ever. Any other ideas on why this happens so o

Fun hack, but - yet another stupid large bank/corporation, probably underpaying their devs and not reviewing code ever. Any other ideas on why this happens so often?

goodcanadian 12y ago
People who don't know much about programming, let alone computer security, doing the hiring. They can't write an attractive job description. They probably don't offer enough money. And, they probably are unable to identify the good candidates reliably even if they do show up. This is a cost centre for the business, not a revenue centre, so it probably will never get the attention it deserves.
- pyre 12y ago
  Seems funny though that the goal of "keeping money protected" is something that the banks want to drag their heels about since they might have to pay for it... On the other hand, "you get what you pay for" seems to apply when they are shopping around for the cheapest devs they can find.
- pbhjpbhj 12y ago
  Wouldn't shoring up holes in security ultimately reduce costs though - safes cost money but banks still recognise the benefit of putting them in, and they don't just buy the cheapest one available. I don't think this simplistic "it's a cost centre" gets to the heart of why banks are seemingly so bad at online security.
- _delirium 12y ago
  If Finland is anything like Denmark, not enough money is probably not the issue. Bank IT is a pretty well-paid job here, near the top of the scale for programmers. But nonetheless has a reputation for being poorly run and just somewhat boring, with a workplace dominated by "suits". In fact you might have to actually wear a suit to work yourself. So it attracts people who want a stable job with no overtime and a large paycheck, and are willing to put up with high management overhead and banking-sector culture.
Kalium 12y ago
On top of the issues goodcanadian describes, people often either don't talk to or don't listen to infosec professionals. Not long ago, I saw a job posting for an infosec person who "Knows how to solve problems without saying no". Security is hard. Hard enough that a lot of people prefer to ignore it.

Fun hack, but - yet another stupid large bank/corporation, probably underpaying their devs and not reviewing code ever. Any other ideas on why this happens so often?

goodcanadian 12y ago

People who don't know much about programming, let alone computer security, doing the hiring. They can't write an attractive job description. They probably don't offer enough money. And, they probably are unable to identify the good candidates reliably even if they do show up. This is a cost centre for the business, not a revenue centre, so it probably will never get the attention it deserves.

pyre 12y ago
Seems funny though that the goal of "keeping money protected" is something that the banks want to drag their heels about since they might have to pay for it... On the other hand, "you get what you pay for" seems to apply when they are shopping around for the cheapest devs they can find.
pbhjpbhj 12y ago
Wouldn't shoring up holes in security ultimately reduce costs though - safes cost money but banks still recognise the benefit of putting them in, and they don't just buy the cheapest one available. I don't think this simplistic "it's a cost centre" gets to the heart of why banks are seemingly so bad at online security.
_delirium 12y ago
If Finland is anything like Denmark, not enough money is probably not the issue. Bank IT is a pretty well-paid job here, near the top of the scale for programmers. But nonetheless has a reputation for being poorly run and just somewhat boring, with a workplace dominated by "suits". In fact you might have to actually wear a suit to work yourself. So it attracts people who want a stable job with no overtime and a large paycheck, and are willing to put up with high management overhead and banking-sector culture.

Kalium 12y ago

On top of the issues goodcanadian describes, people often either don't talk to or don't listen to infosec professionals. Not long ago, I saw a job posting for an infosec person who "Knows how to solve problems without saying no". Security is hard. Hard enough that a lot of people prefer to ignore it.