full-disclosure - Re: Could InfoSec be Worse than Death?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 25 Sep 2006 10:16:30 -0500
From: Paul Schmehl <pauls@...allas.edu>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Re: Could InfoSec be Worse than Death?

--On Monday, September 25, 2006 08:05:10 -0400 "Kenneth F. Belva" 
<ken@...security.com> wrote:
>
[snip]
>
> There is an alternative: Virtual Trust(2) as an information security
> model. According to the Virtual Trust model, security actually creates
> business and generates revenue.
>
Do present day management types spend heaps of money on good will?  My 
anecdotal experience says they do not - at least not in most cases.  There 
are notable exceptions, such as Ben & Jerry's Ice Cream, for whom good will 
seems to be a driving force in their decision making, but for the most part 
corporate types are focused on short-term profits, not good will or trust.

In fact, I can think of several examples where the company's public-facing 
services (tech support, customer service, etc.) seem deliberately designed 
to irritate the customer to no end, yet they continue to do business quite 
nicely.

Whether you approach the "selling" of security from the risk avoidance 
angle or the virtual trust angle or even the fear of imprisonment angle, I 
think the bottom line is, security (in fact, all of IT) will always be 
viewed as a cost center, just as accounting and other support functions 
are.  Unless you can demonstrate concrete revenue generationg directly 
attributable to security, I don't think you can overcome that perception 
(and loss avoidance through trust building does not generate revenue.)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
Content of type "application/pkcs7-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/