151–160 of 186 posts
Earlier quoted context omitted.
Don't quantify security. Just do it. If people ask, just doing my day job' edit: care to explain the downvotes?
I didn't down vote but lots of devs don't have that sweet luxury to not be held accountable for what they're working on in quantitative business terms.
Earlier quoted context omitted.
Yahoo lost $650 million last quarter, why do you think anyone would take the deal in the first place?
IP. Yahoo!'s patents are valued between $4B and $8B, depending on who you ask.
Is it unreasonable to suspect that a company that has had multiples breaches of security of this extent might also not have had its IP taken out from underneath them as well?
One benefit of these incidents at Yahoo! is that they represent salient, clear examples of the cost of poor information security. CIOs and security directors will be able to point to this deal as evidence that poor security can have material impact on the business and destroy massive shareholder value, even years after the fact. A 6.5% intra-day dip sends a clear message. Even a CFO can now see that information secur…
This is a really important point. Yahoo!'s troubles help make a quantitative point to people who care only about money. Having been in the role of advocating investing in security the typical questions are; * "Will the product run faster?", * "Will the customers get better service?", * "Will someone choose us over a competitor because of this?" Generally 'no', 'no', and 'hard to quantify' so the answer to the funding…
How will this pragmatically trickle down to middle managers and their subordinates? With politics and personal incentive that are potentially unaligned with the company's long term interests (not having a data breach), will more resources actually be spent on security?
The return on investment of information security is not obvious / tangible, especially on a quarterly basis. Data breaches are "black swan" events, rarely occurring but with disproportionate consequences when they do occur. It's harder to quantitatively track progress, or lack thereof, of investment into security.
People can (over) claim the amount of time reallocated to security. These claims would be hard to falsify. Teams who are behind on other deadlines can blame time being reallocated to information security. Managers can use the purported reallocated time to spend on feature work, or whatever it is that makes them look objectively better for promotion.
I admit I'm being a bit cynical. I think company culture would help mitigate these issues. Executives valuing information security, even if it's just words rather than policy, nurtures such a culture.
Earlier quoted context omitted.
IP. Yahoo!'s patents are valued between $4B and $8B, depending on who you ask.
That's probably completely wrong. The patent landscape has changed dramatically in the past 5 years. The likelihood they could extract significant sums of money from these patents drops every day.
Earlier quoted context omitted.
This is a really important point. Yahoo!'s troubles help make a quantitative point to people who care only about money. Having been in the role of advocating investing in security the typical questions are; * "Will the product run faster?", * "Will the customers get better service?", * "Will someone choose us over a competitor because of this?" Generally 'no', 'no', and 'hard to quantify' so the answer to the funding…
It's great if the higher up executives / managers starts valuing security, and are more open to the idea of reallocating more company resources (employee time) accordingly. How will this pragmatically trickle down to middle managers and their subordinates? With politics and personal incentive that are potentially unaligned with the company's long term interests (not having a data breach), will more resources actually…
For middle management and below, if upper management doesn't care about security, despite the "look at Yahoo" argument, then you'll find no leverage there for security funding. If they care at all, then managers and individual contributors can argue for security to stand out and accelerate their career. Yahoo's security troubles brighten the spotlight on the need for security funding at companies for training, audits, and setting aside time to do retroactive security work. It's not a silver bullet, but it helps.
[0] OWASP has a lot of great web security resources. Here is their top 10 list from 2013, https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet
Earlier quoted context omitted.
IP. Yahoo!'s patents are valued between $4B and $8B, depending on who you ask.
That's probably completely wrong. The patent landscape has changed dramatically in the past 5 years. The likelihood they could extract significant sums of money from these patents drops every day.
Earlier quoted context omitted.
Other sources [1] estimate the impact on Yahoo's core business, after subtracting out Alibaba's stock movements, at about $1.3B. On a $4.8B deal, that's about 27%. [1] https://www.bloomberg.com/gadfly/articles/2016-12-15/yahoo-s...
Other sources [0] say Yahoo's core business is negatively valued. How much worse could this make it? [0] http://www.investopedia.com/stock-analysis/070215/why-yahoos... from April, but the prices haven't moved too much since.
Now light the chairs on fire.
It can get worse.