Conversation

Notices

1. Embed this notice
   Pseudo Nym (pseudonym@mastodon.online)'s status on Sunday, 01-Sep-2024 04:00:52 JST Pseudo Nym

   #infosec professionals. Do you ever feel like we've gone 2 or 3 levels too meta in our field?

   What I mean is, actually securing a business with 2FA, password managers, and code reviews for #OWASP top 10 issues all seem practical, and useful.

   But once we get into "Cyber Security Frameworks" and iso-27001 audits, and a bunch of GRC (Governance) stuff, it feels...abstract, to the point of being work for work's sake, and not for actually getting the result of improved security.

   Thoughts?

   • Embed this notice
     Jake Hildreth (acorn) :blacker_heart_outline: (horse@infosec.exchange)'s status on Sunday, 01-Sep-2024 04:00:51 JST Jake Hildreth (acorn) :blacker_heart_outline:

     in reply to

     @pseudonym I can tell you from assessing environments from very small to very large, the ones that have the best policies and procedures built out (typically to meet some framework or regulations) do tend to have the most secure environments. And more importantly, they know where their weaknesses and gaps lie.

   • Embed this notice
     Jake Hildreth (acorn) :blacker_heart_outline: (horse@infosec.exchange)'s status on Sunday, 01-Sep-2024 06:05:00 JST Jake Hildreth (acorn) :blacker_heart_outline:

     in reply to

     @pseudonym I would generally agree with that statement… except we still see customers who obviously have a great security culture (lots of stuff done well, engaged staff, knowledge of outstanding issues) but still miss some of the more basic stuff (weak password policies, no separation of duties) because they don’t have a checklist to follow.

     Not sure if this makes sense, tho.

   • Embed this notice
     Pseudo Nym (pseudonym@mastodon.online)'s status on Sunday, 01-Sep-2024 06:05:01 JST Pseudo Nym

     in reply to

     • Jake Hildreth (acorn) :blacker_heart_outline:

     @horse

     Fair enough. But are we sure this isn't confusing correlation for causation?

     I worry that the policies and procedures become an end unto themselves, for checkbox compliance.

     Your observation can be explained by thinking there are robust security cultures, and weak ones, and the robust ones both understand the value of having and following frameworks, and also have good practice. But it's not clear to me that the frameworks cause the practice.

     The culture causes both.