Hacker News Reader

Comment by protocolture | Hacker News Reader

Just like Cryptolocker, this will be the "Finding Out" phase for everyone who has been putting off best practice security.

But, lets be clear, Best Practice will save you. We can engineer assuming there are zero days in path. Go to your CTO now cap in hand and ask for overlapping controls, wafs, application monitoring, backups and all the other shit you haven't been doing.

Because when you find out, I will laugh, it will be very very very funny to me.

View on HN

Meanwhile a huge portion of management and leadership in software companies are encouraging everyone to de facto stop looking at code and let the LLM and a bunch of boundaries handle this for you.

“You are a CISO who needs to review and secure all our slop, and you never make mistakes or you get shut down immediately!”

"You are a Miso soup..."

Which is why you need someone who is responsible for IT security without also being responsible for shipping product. An asshole who can stop releases until security is properly in place.

My understanding is this bloke gets very quickly removed from Fortune 500 companies.

Which is why I am going to need a very large capacity popcorn bucket.

A couple high-profile crash & burns will get their attention.

Just like well-publicized data breaches over the years got people’s attention? Color me skeptical.

The CEO of the company I work for is extremely paranoic about data breaches.

We do a lot of prevention and recovery testing.

So yes, it can happen.

The world is a big place. Of course it happens. But, colloquially speaking, "getting people's attention" suggests that more than a rounding error took heed.

I'm glad your CEO cares. It makes a difference and I hope you feel good about that. And the world would be a better place if more did care. But, to a first approximation, it seems like organizations don't care about data breaches.

Reply on news.ycombinator.com