jrabbit, well, that's what I might be doing with the security thing. We have some.. ways to conceptualize what you are facing in real world, risk management etc. We know the paradigm of today so many are lagging behind. First of all they make unrealistic management decisions, and they don't see the forrest from the trees, the classic spot focus problem.
There are several good authorities in the field who are in agreement with some of the major problems in management so I hope to shead some light on that. People think security, they get certain attitude and that leads them into very blinded world. So I think there's a lot of things to be made only in consulting how to think when it comes to security. That's not what I'm interested in though. I'm more interested in getting my hands dirty. But there are many things that are not taken into consideration at all, that' smostly because the field is relatively new and it has adopted its models from business etc directly.. well they aren't 1:1 even though they have good points.
Ways to prioritize your risk assesment, how much resources should be put into what, because today it's a joke. There are all these dudes telling you all the horror scenarios, the end of the world things. 'Did you know you could attack like this and it would be the end of your business?'. THis is the spot focus problem.
The mental image is, if you have a house, and you paint certain spots, you're still not covered. So you think you are safe and on the other hand you get all these 'the world is ending' messages and you are supposed to invest millions more into something crap, adding few spots but basically not giving you anything back, well that's stupid.
That's stupid consulting. Basically they are tehre to sell so yeah you want to do that, but that doesn't help the business and it definitely does not help the security. So focusing on things, just prioritizing and teaching and opening the big picture so you can make your own damn decisions and be more educated about it etc.. there's so much to be done in that field.
Most managers in this field are all about reaction, when you want to be ahead. At least you should not set your functions to be all about reaction, that's just a losing strategy. And ways to spend a lot of money on things that are imaginary at best.
OH well .
There are several good authorities in the field who are in agreement with some of the major problems in management so I hope to shead some light on that. People think security, they get certain attitude and that leads them into very blinded world. So I think there's a lot of things to be made only in consulting how to think when it comes to security. That's not what I'm interested in though. I'm more interested in getting my hands dirty. But there are many things that are not taken into consideration at all, that' smostly because the field is relatively new and it has adopted its models from business etc directly.. well they aren't 1:1 even though they have good points.
Ways to prioritize your risk assesment, how much resources should be put into what, because today it's a joke. There are all these dudes telling you all the horror scenarios, the end of the world things. 'Did you know you could attack like this and it would be the end of your business?'. THis is the spot focus problem.
The mental image is, if you have a house, and you paint certain spots, you're still not covered. So you think you are safe and on the other hand you get all these 'the world is ending' messages and you are supposed to invest millions more into something crap, adding few spots but basically not giving you anything back, well that's stupid.
That's stupid consulting. Basically they are tehre to sell so yeah you want to do that, but that doesn't help the business and it definitely does not help the security. So focusing on things, just prioritizing and teaching and opening the big picture so you can make your own damn decisions and be more educated about it etc.. there's so much to be done in that field.
Most managers in this field are all about reaction, when you want to be ahead. At least you should not set your functions to be all about reaction, that's just a losing strategy. And ways to spend a lot of money on things that are imaginary at best.
OH well .
Comment