Hacker News Reader

Comment by dragonsky67 | Hacker News Reader

One of the things that seems to be missed a lot of the time is the cost of cybersecurity policies, tools and the workarounds users are forced to use to circumvent cybersecurity policies.

Password change policies - say no more, virus checkers - slowing down workstations for minimal benefit, internet access filtering - Businesses doing deep packet inspection on the off chance that one of the staff members might bring in something nasty.

The cost in time and frustration is over the top and the benefit is mostly around perception.

The reality is, that if somebody wants to compromise your security, they will find a way. The chances are that it has already happened and you have no idea about it.

I'm not advocating do nothing, but there needs to be an understanding that most of the measures taken these days are patches put in place for broken software, incorrect configuration and poor user education.

View on HN

Wow that is a bad take.

> virus checkers - slowing down workstations for minimal benefit.

Being able to stop known malware is a significant benefit.

> internet access filtering - Businesses doing deep packet inspection on the off chance that one of the staff members might bring in something nasty.

Doesn't have to be DPI, being able to say "hey this porn is not okay during work" is absolutely fine. Especially if there's malware out there that redirects you around to sites you might not want your customers to see.

> The reality is, that if somebody wants to compromise your security, they will find a way.

That's such a lie by omission, there's a lot of unsophisticated spray-n-pray type of attacks out there.

> Wow that is a bad take.

> > virus checkers - slowing down workstations for minimal benefit.

> Being able to stop known malware is a significant benefit.

Having been part of a malware debacle that essentially circumvented two different av/malware tools it's hard for me to find a pragmatic balance to the year's worth of absolute hell the tooling caused to the systems I'm responsible for. (Log bombing, HDD I/O stackups, chained immune responses and deadlocks to literally nothing) +25% or more resource consumption _just_ to keep the AVs happy.

Couple that with needlessly aggressive IT policy (see Mordac, the preventer of IT services on steroids)

There's got to be a better way, but maybe this is the new normal.

The challenge is that chief executives, boards and audit committees set a tolerance to risk, like they do with all other risks. And those responsible will not accept a high level of residual risk, so we put controls in. The challenge is knowing what the best controls are.

Chances are if its already happened and you haven't detected that it has, then you've really not taken cybersecurity seriously.

Reply on news.ycombinator.com