Comment Re:The really important thing here (Score 2) 21
Security is not quantifiable; no one was ever rewarded for the hacks that didn't happen. The only question remaining is if the board has enough sanity to hire a CEO who won't incentivize financial performance at the expense of security.
I'd agree generally, but I wonder that in the end, it's actually irrelevant whether security is quantifiable. Sure, we could estimate the cost of a breach, estimating the risk of it happening, and even make a very credible job of it, but those numbers will often get the security dept people nowhere.
Why? Leaders think they are lucky and that they will get away with it.
If they were pessimistic scared pedantic types, they wouldn't be leaders.
And the technology is fragile. So it isn't really their fault. They have to succeed in the market whilst dependent on inherently fragile technology. Their only reasonable bet in that situation is to hope they stay lucky.
And by inherently fragile I mean, you buy it and it should just work, not this, hire an army of people to perform rituals and sacrifices to try to stop the company's crown jewels suddenly leaking out of the hole in the bottom of your coffee machine's waste basket.
Why the tech is so fundamentally fragile, despite many brilliant people creating it, is an exercise for the reader.