When I used to work in manufacturing, my company was super into Lean. I even ended up getting an ASQ Six Sigma Green Belt certification. My favorite thing to say to people when they asked what 5S stood for was "Shove Stupid Shit Someplace Secret". In my experience, that wasn't an entirely inaccurate interpretation. Joking aside, I think this article does a decent job of translating Lean manufacturing principles to co…
> "Shove Stupid Shit Someplace Secret" This sums up the broad concept of Compliance and security in general. The people who pretend to care about compliance (i.e. management) don't have the technical know-how to grok the implementations by those who pretend to implement said compliant systems. There isn't remotely enough QA/red-teaming (expensive to do in a bias-free manner), most of the time all you need to do is sc…
The part I found interesting is that the premiums vary based on their assessment of your practices. This strongly aligns their incentives with actual best practices when evaluating your systems, as they are on the hook financially for any breach.