Hacker News Reader

I attended CISO course run by Uni of Washington https://www.washington.edu/research/research-centers/center-... It was total garbage by clueless paper pushers. Main focus was on securing business agreements delegating responsibility, aka deflecting the blame. There was zero time spend on actually securing anything, it was all theatre or/and way of funneling funds to select companies from private sector (like Kronos).

View on HN

I wouldn't say it's the main focus, but this is an extremely valuable risk treatment. I would say it's underrated.

Too many orgs go into do or die mode and try to do everything and do it poorly. Accepting risk is a liability no person in authority ever wants to sign, even if it's accepting the risk of an earth destroying comet. They will ask you to do what you can instead, when you don't have enough resources to even begin implementing the needed controls.

Often in info sec governance literally the only way for us to get leadership to accept a realistic scope is to do as much risk transference as possible.

Reply on news.ycombinator.com