Hacker News Reader

Comment by markus_zhang | Hacker News Reader

Why treat anything serious if it doesn't impact the board? I wouldn't either if I'm in that position. For sure I'm going to hire consultants with coats made of certificates and then sleep tight. I have done what the law or insurance company wants to see and I have consultants as black sheep. What on earth do you expect me to do more? Better processes? Sure let me hire more consultants wearing suits...

View on HN

> I have done what the law or insurance company wants to see and I have consultants as black sheep.

You hit a great point. The law and insurance companies have a major impact on what companies do.

If it's illegal (and they'll get caught) or the insurance companies say "do this to get insurance or if you don't do it the insurance doesn't cover you" people will make change.

That right there is a way to bring change.

Call your gov reps.

Let's get insurance companies to put security controls into coverage policies.

One thing I'm a bit pessimistic is that insurance policies usually bring a lot of paper work and eventually it's just certificates over certificates. But again, maybe (a big maybe) this is still better than what things are going on right now.

The best solution is for board members to have respect to their best techincal people and let them create processes best for individual companies. Sadly this is too personal and usually dies when a couple of people jump ship.

Damn, management is so hard.

Hopefully that make those certificates worthwhile someday. Right now they have earned a bad reputation, but with the right training behind it things could change.

The problem is always the same: to do things right, you need people who know what they are doing. Redundantly. Yet, most of us don't know what we are doing, so in practice we end up creating proxies for "the people who know what they are doing according to their certificates certify that I know what I'm doing". Because otherwise you wouldn't be accepted in a cool position, and we all want to be in a cool position. And that's how we end up with so much shit overflowing in the world, but people still pretend they have their own under control. Feeling greedy? Play pretend. A few hours later... Want to be accepted? Play pretend. A few hours later... Want to not be left out? Play pretend.

Except that there are real attacks and the insurance companies affects will do postmortems to figure out why what they demanded didn't work. It will be a few rounds before they figure out how to train for this though. More than a few rounds because the bad guys are not stupid and thinking up new things that smart good people need to mitigate.

You forget that the board is also full of slightly-more-official-looking guys wearing suits. Guys in suits often forget that there is more to life than appearances, and that there is a cold hard reality unaffected by spin. Ransomware is gonna ransomware regardless of how many boxes you check and how shiny your suit looks.

That's exactly what I'm trying to say. I don't have high hope for this.

I'm sure Experian's data breach went to the board. I suspect other boards have started asking questions to ensure they are not surprised by such things.

Reply on news.ycombinator.com