> The problem with security is that it’s impossible to measure your ROI
Sometimes I wonder what we lost by only working on things with measurable impact
Nobody Cares About Security
11–20 of 93 posts
Re: Nobody Cares About Security
#12The author ain't wrong - security has a massive usability issue, and a lot of legacy security vendors don't seem to care about understanding the UX or workflows of various different personas. The newer generation of companies and startups are better, but it's still a work in progress.
> security has a massive usability issue
Security cares about nobody.
Re: Nobody Cares About Security
#13> The problem with security is that it’s impossible to measure your ROI Sometimes I wonder what we lost by only working on things with measurable impact
[deleted]
Re: Nobody Cares About Security
#14Surprisingly few companies (or people) care about paying for good security.
Would argue the opposite. Many people pay cloud providers because of the built in security and auditing. See AWS gov cloud for an entire sector.
Re: Nobody Cares About Security
#15Disagree. Security isn’t just about recovery. Say you get breached. Many threat actors are well aware of global privacy laws and exfiltrate data and threaten to release it if not paid the ransom. Some go a step further to notify privacy regulators of the breach to further leverage ransom payment. Recovery from an encryption event is great and all, but it doesn’t solve the problem of your new regulatory fine and legal…
Isn't that basically the author's point? > This brings me back to my original point: Nobody (i.e., business leaders) cares about security. What they care about is avoiding lost revenue due to application downtime, extortion, and lawsuits. Followed by arguing that fines and reputation loss, under the current status quo, aren't seen by business leaders as being extraordinarily disastrous.
I guess the free market will determine what security is worth. Extortion demands will rise until they stop being paid. Then we will know. Unfortunately the real victims (us) will not be part of the negotiations.
Re: Nobody Cares About Security
#16Strong agree. I'll tell you the other reason not cited: it slows down organizations. Doing things right to avoid the (seemingly) small chance at being massively wrong is the inverse of the bet that doing many different things quickly has a small chance at a massive payout.
Let's say I'm an executive and I think there's a 1% chance of a breach that costs me 100x and a 1% chance of a 100x payout on every project.
I have 2 projects that each make $X. Let's say $X is $1000. 1 project will go from $X to $X/100 based on breach, so it's now worth $10. 1 project will go from $X to $X*100. It's now worth $100,000.
I went from making $2000 to $99,990.
This goes back to the argument about fines. They aren't NEARLY severe enough. If I'm an executive at a big company, I may enforce greater security on the "cash cow" projects (e.g. ad revenue and GSuite at Google [but not the Pixel or GCloud], AWS and Retail at Amazon [but not Alexa, Kindle, etc]) but the rest? I need to get ANOTHER cash cow. If my service that's only netting me $1M/year goes to $0, and I needed a service that would make $1B, I literally do not care.
If adding in-depth security to the $1M/year project makes delivery 2x slower, I've now spent 2x on something that probably wasn't even worth it. This is a game of stats; businesses and features as cattle not pets. I'd rather have 2 projects and another dice roll than 1 project that's just "meh".
That's not how I operate, but if you're playing this game as an executive, that's the most logical outcome.
Re: Nobody Cares About Security
#17Software security is the absence of vulnerabilities, which is a special case of the absence of bugs. People are not interested in security because they are not interested in quality. Even those environments that are supposed to be high security, are in fact buggy, slow and very frustrating to use - revealing that they are almost certainly riddled with vulnerabilities as well. It's implausible that a system could be secure if it's not also the highest quality you've ever seen.
Re: Nobody Cares About Security
#18Remember: nobody likes the safety inspector, everybody loves the fireman!
Re: Nobody Cares About Security
#19An angle that sometimes helps is reframing security as (business) validation and introducing proper type modeling.
The best thing anybody can do for this is making apis that make `unrepresentable` unsafe things.
` A classic is password length. Instead of `login(user:str, pwd:str)`, do `login(user:NotEmptyStr, pwd:ValidPwd)`.
This is stuff that must be done in the lower layers, to take advantage of how lazy people is. Do it for the most popular libraries and frameworks and we are talking about real impact.
Re: Nobody Cares About Security
#20I've been saying this since at least 2009 when the company I worked for was sending credit card info from card readers across the network in plain text and they dragged their feet to fix it even though they knew we were violating some serious SOX policies.
At another company in 2015, I discovered we were sending user credentials for a large hospitals in plain text across the network and need to fix this ASAP. When I brought this up to management, they shrugged and said "it's been this way for years and we have other priorities". After a large New York hospital was breached, I suddenly had management show up to my desk in panic asking how we can fix the issue immediately. I came up with a nice write-up for both our company and the hospital IT groups on how to secure our infrastructure with certs and whatnot and they still half-assed it with self-signed certificates.
In 2018 I worked for a fin-tech company in charge of some A-list celebrity 401K portfolios. We had a default admin password for our production database. ZERO encryption on the data; including SSN, birth-date, phone numbers, addresses, beneficiaries info, etc.
Last year one of the leading payroll providers in the country (USA) I used to work for started aggressively out-sourcing the software and allegedly had a really nasty security breach due to a back-door inserted by one of the out-sourced team members. It's alleged that leadership threatened employees if they disclosed the incident to anyone outside a key group of members.
Nobody give a damn about security until their identity is stolen and they have to spend hours/days/weeks/months putting their lives back together from the fallout.