Hacker News Reader

I've come to a point where I really think no company will ever have even competent InfoSec practices. I've worked at a fortune-100 (terrible due to scale probably), a small InfoSec consulting firm (terrible due to lack of scale and non-caring leadership as ironic as it is) and now a global firm (terrible due to scale and poor training).

I have no idea how to solve this problem, it seems impossible.

View on HN

Hiya Kevin. I wrote that Inc article. I feel you. How many times have you seen one (or all of these)...

-credentials shared across teams -database credentials stored in plain text config files -unsecured mongodb clusters

I used to think that none of this stuff would change until people were held accountable. Imagine if a data breach at work meant that I had to pay a fine so steep that I had to declare personal bankruptcy...bet that might get people's attention, but I doubt there's the political will to pass laws like that.

Instead, I've spent my time trying to tackle it from the other end of incentives- how do we make security tools easier to adopt than the alternative? The SSO guys have done a great job, but there's plenty more to do.

*Full disclosure, I founded a data security company

Mass casualties directly blamed on infosec failures would probably kick the legislature and public into action, but GOK what that action might be.

Reply on news.ycombinator.com