3 ms·
I don't think we disagree. I'm certainly in full agreement that companies should take it seriously and often don't. However, being breached does not mean that y
by lvh 11y ago
I don't think we disagree. I'm certainly in full agreement that companies should take it seriously and often don't. However, being breached does not mean that you did not take action. The article I was responding to doesn't distinguish between a breach after an ounce of prevention, or no prevention at all. Is it realistic to expect a health company to have prevented a breach if that breach is a consequence of an Exchange 0-day?
- wglb 11y agoIf you are hiring security professionals, it might be helpful for you to keep in mind for your new hire folks and for your customers that there is a new metric underscoring the thesis of Troy Hunt, who is quite experienced in this industry: MTBCA -- mean time before CEO apology: http://blogs.forrester.com/rick_holland/15-05-20-introducing_a_new_incident_response_metric_mean_time_before_ceo_apologizes_mtbca http://blogs.forrester.com/rick_holland/15-05-20-introducing... Is it realistic to expect a health company to have prevented a breach if that breach is a consequence of an Exchange 0-day? The topic of the article is that the breaches have gone on for a significant fraction of a year. If that is the case, that there are intruders waltzing in your network, it is hardly appropriate to say that you take security seriously.
- sneak 11y agoObviously - wtf are they doing running Exchange?