People speak about the "security poverty line", but the harsh truth is that there is an "engineering poverty line" in tech, and many large, world-famous companies fall below it. Good security is normally a result of healthy IT engineering culture & competence; reality is that ...
... most organisations really struggle to keep their stuff running, or inventoried, or approximately clean. Many famous brands fail at doing "simple" things like having a working payment workflow on their website; discussing proper security engineering when they can't get ...
... even business-critical things to run reliably is like discussing proper swimming form with a drowning person.
There are many reasons for this situation, but it should give us pause that - as IT has gotten crucially important - so few organisations are on top of theirs.
There are many reasons for this situation, but it should give us pause that - as IT has gotten crucially important - so few organisations are on top of theirs.
The tech giants can afford top-notch engineers at very comfortable salaries, and they usually stay *barely* on top of their IT - what about any org where IT competence is not part of the company DNA historically?
(the above thread needs to be partially credited to @dinodaizovi; it came up in a discussion between us :-)
