Security Program Is Shit(crankysec.com)
crankysec.com
Security Program Is Shit
https://crankysec.com/blog/shite/
16 comments
This is almost my current employer to a tee.
I hope to take the same action as you in the near future.
I hope to take the same action as you in the near future.
This so accurately describes the last week of my life. Years of shrugs and "we will get to that when <moving goalpost>" when security concerns are brought up. Thankfully, we had done some of the work anyway and were teed up to do the rest quickly enough. Still sucked pretty hard.
This reminds me of something we wrote a few years ago about PCI compliance:
https://rsync.net/resources/regulatory/pci.html
https://rsync.net/resources/regulatory/pci.html
The misaligned incentives for security is the core issue, so stronger regulation is needed. Breach happens? entire executive team ought to get most of their remuneration clawed back.
This assumes the breach is disclosed. Most hide them.
No one disagrees. Consider project management; for example, which has had many failed projects, has evolved, is still incredibly imperfect. Health care services, have had many flaws, continue to evolve, are still incredibly imperfect. Marketing, has had many flaws, has advanced, is imperfect. Pick one or two problems and advance them. Try not to kill people in the process which is all too common in tech.
Ultimately, the problem is self-interested people, misaligned incentives, and insufficient legal recourse for victims.
What's the motivation to do anything right in security if most of the time you don't have a breach and you can get away cutting corners? When something does go wrong, you can blame it on underlings, claim it was a "sophisicated attack from nation-state actors", and rely on the public to not care?
I don't know that security is comparable to project management, health care services, or marketing. Inefficiencies in those have visible costs and reasonably good incentives for improving them.
What's the motivation to do anything right in security if most of the time you don't have a breach and you can get away cutting corners? When something does go wrong, you can blame it on underlings, claim it was a "sophisicated attack from nation-state actors", and rely on the public to not care?
I don't know that security is comparable to project management, health care services, or marketing. Inefficiencies in those have visible costs and reasonably good incentives for improving them.
That’s when you step away. Come back later and take that last statement and spin it to a question instead. Can security have viable costs and incentives- what is a new way to improve it? Can’t see opportunity any more then take a break. I hate the nation state lies they muddy the real issues. That is not saying there are not threats, yet the hype and lazy attribution isn’t improving anything.
This may not not a popular opinion, but this honestly comes across to me as a sad rant that has nothing worthwhile to say about security.
Consultants get paid to come in and advise, and internal staff are ignored? Suck it up, it's not a problem particular to security. I've seen it everywhere.
People don't choose hospitals because of their security program? Well, duh. They don't choose hospitals for all kinds of non medical reasons that are still vital for the damn thing to function. Get back to me when you're in surgery and the whole hospital goes down in a ransomware attack.
Honestly, if I had to listen to this person on my team for more than 10 seconds, I'd be on the phone to Deloitte before you could blink.
Consultants get paid to come in and advise, and internal staff are ignored? Suck it up, it's not a problem particular to security. I've seen it everywhere.
People don't choose hospitals because of their security program? Well, duh. They don't choose hospitals for all kinds of non medical reasons that are still vital for the damn thing to function. Get back to me when you're in surgery and the whole hospital goes down in a ransomware attack.
Honestly, if I had to listen to this person on my team for more than 10 seconds, I'd be on the phone to Deloitte before you could blink.
Yeah, it's basically true
[deleted]
Shouting truth into the abyss. Great read. My CISO chuckled.
I think the "Your" got dropped from this. Should read:
You Security Program Is Shit
You Security Program Is Shit
[deleted]
So glad I quit that job.